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J. Purpose; | 

The purpose of thts policy is to promulgate the Court tefternwfsm PoAcy Gu/iiJe (CTPG). ! 

I 

I 

8. Polity Sldtenient: ! 


8.1, All Federal Bureau of Investigation (FBI) employees, detadees. contractors, task force e i e wbefs , 
and others responsible for performing counterterronsin operaibons m furtherance of the m«eioft of the 
FBI must comply with the policies and procedures contained m the CTPG, ivhich are corm a tert ib^. 
Jaws, rules, and regulations governing FBI investigations, operations, programs, and actr<rrties See the 
CTPG for these policies and procedures. 

8.2. Any revisions, amendments, or updates to this PG must be coordinated through the Intemai Pohcv 
Office (IPO) and the Counterterronsm Division (CTD) divison policy officer (DPO) and other refevaf^ 
stakeholders (as determined by IPO and the proponent division). Resuttmg changes must then be 
approved by the CTD assistant director (AO) and the Nationa) Secunty Branch executive assrsiant 
director (FAD), as appropriate. 


9. Scope; 

This directive and the poliaes and procedures contained in the CTPG appfy to aif FBI err^Jfevees, 
detailees, contractors, task force members, and others responsibfe for perfonrang oour^wTerronsr' 
operations. 


10. Proponent: 
Counterterronsm Division 


11. Rotes and Responsibilities: 


u 
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fbiM 


1.1. *»u|iersf>s<ion: 

This PG supecwdes Poliry Direct ivp (PD) 049^0, Countcrtsmuism Pvhcy Guide, and Iho 
Coun ter twro ns m Polny Guide, 0494PU. 


14. Reloremcs. I inks and Inniis; 

14.1. References 

14.1.1. FBI Domesfir /nvestioaf/ons end Operations Guide (DIOG) dated October i Ci, ?0I3, and any 
approved, subsequent iterations. 

14.1.2. Foi additional references, key words, and links, please see the CTPG. 

14.2. Acronyms 

14.2.1. AD; assistant director 

14.2.2. AGG-Dom: AttomeY Genera/'s Guidehnes for Domesbc FBI Operabons 

14.2.3. CTD; Counterterrorism Division 

14.2.4. CTPG: Counlwtemjnsm Policy Guide 
H.2.5. DPO: division policy officer 

14.2.6. FAD: executive assistant director 

14.2.7. FBI: Federal Bureau of investigation 

14.2.8. IPO: Internal Policy Office 

14.2.9. PG: policy guide 


IS. Key Words, Oefinitions and Acronyms: 
ffie CTPG. 


jl6. Appeirdices and Attachments: 
the CTPG. 
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(1 ) (.fiifi al liiToi iii.itiuii 

(in Qur^tiini^ Of ccmimrntv pntaiiujip lo tins poUrv piide ran lif tiuectrd lo 
O ' TOl'Oi F-rtinal Bureau of Iinestigation Ht’adqioitri'i C oimintenonsm Divi^inn Divikkmi 1 1 

(i n Otfii’f ot tlie As&i>itaii1 Difeirtoi 

(\ * TOl ’O) DiMMOti pouil of coiitat't I Uiut accessible \ia 

Oullook al 


O') Siipei session Information 

(1" TOUG) Thiv poUcv guide supeisedes ihe Courttertetrorism Polny Gmti^ policy tluecux e 
(0494D) and the Counterten-onsm Pohn Guide (Ot94PCi) 


0. '» TUi*' docunienl and iis coiiimu are the piopeitv of the FBI If ilie docimieui oi iis ccmtenis 
arc presided to an outside agetKV it and its contents air not to be distributed outside of that 
agency wiOiout the uTiftcn penrassion of the luui oi tndtvuhialls) listed m tlie contact section of 

this policy guide 


V 
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4.3. d’^) C ouuteiierroiisin Piofram Bas^o*- f oll#<fioo Pla» 

4.3.1. fl ) IntfUigeucp C oDeflioo aod Rf^porting Slial^ 

(U//FOUO) In an effort to standardi 2 e tnformatioD and imelbgence coUecMia^ m wdl at pro^-tit 
investigative guidance for both DT and IT imestigatioos CTD has e^abltsiied ao «r.«*»«atr.e 
framework collectively refmed to as Ijaseline coUectioci " The purpose of basebae coClertuB is 
to guide investigators in obtaining intelligaKe and iianp im estimative m et hods ckrag die course 
of each DT or IT investigation Baseline coUectioD a not mandatorv and h not an 
listing but rather a best practice Ust of items that mav be accomplished when lefalfy peniwwdifc 
relevant and consistent with the DICXr during an assessmeni or preheated mrestigsatioii 

(U/TOUO) Baseline coUeebon was established to provide progjassnaoc staodards as lenm of 
the quahty and thoroughness of assessments and predicaied imestiyaftions Baseline coflectue 
can help prevent gaps in mvestigaiivT effons FOs are reminded th^ aU imTsixB«r.« efibm are 
subject to the AGG-Dotb and the DIOG The least inbusne means of imesaicaaoo cofiecnaB 
must be utilized under the AGO-Dom or DlCXi (refici to the sectioo on least immsiVT methods m 
the DIOG) . Baseline collection is uitended to servT as a guide throu^ die vanous mvesofaiivc 
stages Common sense w'lll be applied when deterrmning wbetha a particulv acm rcntaoied m 
the baseline collection pertains to a specific assessmeiH or mvestigactao If there b dcute as lo 
whether the appropriate authonts’ exists m an indriidual imestigatioD io address a baaekae 
collecnon item emplovees are to catsuit the chief drv'isioo counsel ‘CDC OGC andor the 
CTD program manager 

(LT^ FOUO) Supervisors may address baseline coUecnon with case agents dunng anestigacve 
file reviews and such reviews will inform mauv of the in^lhgeoce and coUectsoc tnjstes^ 
requued for review, m accordance with DIQO subseclioo 3 4 4 6 In adefanoa to 9Cmdar<bzsaf 


13 

SEC RET>>OFOR.V 


SKC Kl.l//NtH f)KN 
(It) ( '<Yimtnlrii(niMit IHiIk y (lUiili* 


iiiftniivtlKm 4 it(l mlHIifTctMT iotln’luvii luKrlinr rotltHlimi will tirlp In rhUbliKli ;i iniuKUliim nl 
tiitf’llipnKr iqMtii wliirli tht*- Mil tliav b>i*«** tJl(‘ iln iKUHi in ( ntilinnr ni t liMi* 411 a.<isr^.siiinil ni 
inxrstipalinn 

(lJ/-TOlX>) rolIrcUnti iletim aic in nn pHittriilai intUn 1 lullifiiiinif iiirninialion rinl 

tailed fm by luveline rnllrtiinn ii»v *ls« In* rnllnied ifle^^lv imnnsHihlr |Natii( al and 
lel^vanf In the in\Tstip.aUofi llasrliiH' cnllcviinn also involves 1 nnvtdeiatiofi nf the < n'llilnlily <d 
die ntipiul mfomiation ni somie of infonnalitni iti teinis of [nnlu alinn If tlir t letlibihlv of tJie 
nti}?i:tnal infoinuUnn 01 snincr is evil stibslanliallv qiiestiinted any buUiei invesliiviilinn based 
iqion tlie uifonnaluni ni soiirre nuisl lie lerv^ualed to deleiiiiine wbetliri piixiiralioit ('ont]niH*s 
to exisl No inveslipativT metlioif will be used if nifniiiutinn is tlevelnjied Uwt sif^iifn aiitly 
undenniDes the purpose m ptedit aiion of the assessment or invesli^tion 

(U/'TOUO) This standaidized a}i|Koacli to all CT iiiveslip.aii(Mis will allow C ‘Tl) and f'Os to rnoie 
eflrctivelv and efBcienllv nianape CT investigations CTD will tnamlaui an open dialogue witli 
aJl FO CT siipeivisois m order to identify intelligence gaps [Jiovide giutlaiice and 
leconininidations and cnsiue all available CTD lesomces are ap|Jio|mate]y utilized jti each 
invTstigaPon 

4.5.2. (T ) .Vssessmeuls 

(U< TOUO) In CT Tvpe 1 A 2 as-sessments mvesligalors may. when relevant to the piupose of 
the assessment, collect die information that is necessary to answer the questioii-s detaileil below 
in Category A (refer to subsechcn 5 3 of this PG for a list of autlion/ed nietliods) Hie 
assessment may continue until factual mfomiation is developed tliat warrants opeiuiig a 
predicated invTsngatioii oi until a judgment can be made lliat the target does not pose a terronsni 
01 cninuial threat Assessments may not remain open solely to collect more infonnation if the 
purpose of the assessment has been achieved ot if tlie mfoirtiation is not necessary to adueve tlie 
purpose See DIOG Section 5 for additional uiforraation regarding assessments 

(U'TOUO) In CT Tvpe 1 & 2 assessments, diere are also specific, mandatory baseline collection 
requuements Refei to Policy Dnective (PD) 0649D. ^fimdaror\ Baseline Colle cno’i Z^.» f’jc 
Cnun ijrterron ^j K 1 C F: -t .ucsi if kvjrj for a discussion and hsi of these requirements 

4.3.2. 1. (V) C alegoiy A Questions 

CU' TOFT)) To answer the Category A questions accuialety database checks w ill be necessary 
This mfomiation is to be collected if it can be done with tlie methods autliorized durmg an 
assessment 

(U) Xote; National seciinty letters (NSL) and admmistrative sul^K>ena.s .vre not 
authorized durmg an assessment Grand jury subpoenas (GJS) are hnuted to subscnber 
infonnation only for Type 1 & 2 assessments See DIOG section 18 j 9 Investigative 
Method- Grand Jury Subpoena.s - providers of electronic coimimncation services or 
remote con^ruuug services for subscnber 01 aistomei infonuatioii 

{U/TOUO) Category A questions are* 

1 (f 'TOUQ) The subject s fiiU. legal name and aliases, if any 
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(t/) Nf»tr Sofir fUtKDialilir^ jnrf f ulfutri tk> nrirf brfinr^ fir«t mKlrir> 

UhI iLuiirs in |})r tiuntn M thr IJtnljni mgy tn^mr 

liirt JiK i»f rjf h <»} iIm* ktutvm tumtta pijf m tfir pfn^btm ai ffer Lm( namr 

? (U/^f 0( i(>) fltr stil^ra't d;itr Aii4 ( wi0i y (4 birAj 

i ( U//J'< )l /< >) A flrtn ftiiruitKm r/f (Ir wjbfi^ • ( imtie4 Sutri pnvm (VSPf.^ ) yis0M HHn 
t« (/ [SWKfil/^f'iK>f‘f>RN drjr'iitnmiJ of ibr 1/^4 s 

4 (U//H)I JO) rlir {JiiMptHt and rourtry of iMuanrjr 

6 fU/^OUO) fltr ^ib^m & mituI wrurity rojfiihrT fSSN) (if nJbftri rt m (JSPfJR) aoii 
any othrr uiiiqur idmtifyinp nufitljrr^ telrvant to datahasr fiiieck* (e g. alms teiasbMaoo 
niimbn and diivn '% lii'^nKf aumlirr; 

6 (U//FOrjO) The subject s telephone e mad aEkkewfca/ and* or otfiCT Rtfenrt 

conunumcation media utilized by die subject 

7 (t/J/T OUO) The sidijcct s cmroit addrm and a«iy prior adrkesrfes) partiraiarly 4 1 
appears that the subject recently relocated It will normally he uonccewry to ateertato 
previous addresses more than five years old 

8 (UJ/f Ol JO) The subject & currem place of engrlovnieDi aod posdioc 

(U//TOUO) When avail^le idenufying tnfofmatioD has been obxaaied n say be used Id coadttcr 
the checks necessary to answer the follofwmg questtoiB These {gietsbocK are ^eneraDv idrvaot lo 
all CT assessments Only informatron about the subject that ts reks^ot lo answermf these 
questions or otherwise resolving die assessment may be documented tc FBI filei. Engdoyees sre 
to avoid collecting or documenttog personal mformation about die sbbject dial ■ ool ledct'xM id 
the assessment The questions below are not in any paritcular order aod are not aH-mriunw The 
least intrusiv e means if reasonable based upon the cncumsiaoces <4 the mvesogabac is to be 
considered to answer each question 'A'hile some databases are suggested open squice 
information may also be checked to answer these (pjcsboos 

9 (U/^OUO) Has the subject e\ei been the target of or been referenced m aoodia' FBI 
investigation'^ Query the FBI s central recorcficeeping sv^aem Guardtan and or the 
Investigative Data Warehouse I'lDW) or other FBI recdrc&ecpiiif ryslems 

10. CU 'FOUO) Has tlie subject s current address or place of work been lefaeaced m olho' 
FBI mvesngahons'’ Querv the FBTs cetural recordkeepiaf ssstem. IDW as other FBI 
recordkeeping svstems 

1 1 (UJ'TOUO) Does the subject have a cnminal history (a comictiOQ or si aiest > that is 
relevant to the assessment s puqx>s>e'’ Pro&-dm cn cmncs snc^ s a aad idciBify thrd 
and deahug ilhat narcotics mav be as relevam to a CT assesscma a£ cranes of ^soknce 
and or firearms siobtions Anv active arre^ wanam be Dotmi m the ^sessnest 
Querv’ federal state, and local cnmtnallaw^ enforcemen! sv'siems such as the N^Aocal 
Crime Information Center ('NCIC) state Departmem of Motor Vehicles (1>MV^ and 
othei local systems 
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lv Ihnr irxsmi to tfchrvi' (Ii;i1 llir mtiycn'l luu Imh*!! iik lrlrf>li<ntc nniLwi will) 
KuUftn'lH of iHlin Mfl tnvTsUyviitiiOiis? If «> ((Hii|>air llir irlrv»ji1 (LtlAcmicintiiny, llii* 
hiibieii \ tflrplioiH' untlt Mil ctiUltAHcs iuui as i titaliuM 

tiiilL''tinit*hiie aiiaiv^is ijKtriy rH<’|>lioiK* Ayiftliratitm (TA). IDW l*ohiii*;/C'U'aiwafrt 
DaU Wairliousr S\’slrfii fDWS) aiul Data .ukI Aiialy^iK SvHlnn (Dal^S) 

I i (IJ/IXM Kl) U llicte i^isoii to licUevr dwi dir uubjct l Iias limi in r null rontac l willi 
subfctis of otlin Mlil mvr^itip^tions ^ If so roiiip;ur letrvaiit iiata coiu nninyr, tlir 
subfrct's r mail arroimtfs) with MU daUtiasrs. and as ap{)iii|nialr rondnri link/hinrhiii' 
anaivsis Qnnv IDW Polajis t lraiwaln DWS andDalAS 

14 (LP'T’OUOl Is tlittr au\ irason to Iwhrve dial the snbjetl lias access to liazaidous oi 
explosive matciials** An uidicaUon of such nuy mcliule any sjjrcial licenses or prnnits 
(e g a conimetrui iliiver s hcense |CT)Ll widi a lia/ardous nutciials | Hazmat] 
eadoisoiieut) dial audiotizr die snbircl to obtain oi possess explosives or other 
dangerous nuterials 

15 fU/ 'FOT.TO) Is diere any reason to believe dial die subject lias purchased or is licensed to 
possess fueanns or other vs'eapoiis'^ If so. nm NCIC checks anchor ccmtact local Bureau 
of Alcohol. Tobacco Fuearms and Explosives (ATEl representatives or any available 
state database ui tlie relevant jurisdiction to collect responsive records and mfomiation 

16 (U' TOUO) Is there any reason to believ^e, considermg the subject’s background 
en^losTiieni lustory and crimuial lustorv dial the subject has received specialized 
training or experience or has knowledge that is relevant to die un estigadon (e.g.. tmlitaiy 
semce Law enforcement, fireanns. explosives, pdot^asiatioii. scuba diving, engjneenng 
architectural, computer science, phamuceutical. cheimcal biological, radiological, 
nuclear or sumlai subjects)? 

1 7 (U TOVO) Within the past year has die sidjjecl traveled abroad to a coimtryfies) 
relevani to die assesstneuT* Qiiery the TECS. Airline Reportmg Corporation (ARC). 

DOS s CoiLsular Consolidated Database (CCD), and' or a DOS liaison requesting an 
USPER subject s passport apphcatiou historv' 

1 8 (V TOUO) Does the subject live alone or with anodiei adult(s)'’ If the subject lives with 
another aduli(s). is there any reason to behexe said adulds) is uivol\‘ed with the matter 
under assessment'^ 

19 (U' TOUO) For a subject with an inteniational nexus, does die USIC have any relevant 
uifonuation about the subgecl'’ Query^ die FBTs central recordkeeping sy'stem. Guardian. 
IDW^ die National C ounterteTTonsui Center (NCTC) Oolme. a DOS liaison (non- 
USPERs only) aud or other USIC databases 

fU TOUO) Note The appropnate CTD program management umt can assist m seeking 
mfonnation from foreign mtelhgence law enforcement agencies Comae tmg foreign 
agencies is a relatively mttiisi^ e step because it reveals the FBTs mterest m the subject, 
especially if tliat subject may n avel to that foreign counhy ui die future. Accorduigly 
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Ht 

ft/) < ^nvrfrffrttotiwn i*fAity ( ^tult 


«Uf:h r arilarU niiMt (tr roofdnumd Harnif^ f.'/l) ml finly vvtim tfir jvsiibMr mformUMn 
liMtif'm Ihix IrvrJ uf ifitiusion 

20 fl///FOI/<)) f^juld tir wiijwi i « otfirr activitm rnkonaMy «u|)fMrt (hr rjoww 
rolirrbori m bamfn of nionry of fixvk (or tnrorruB or ' nfUKul pury>rivn ^r y» 
atport/ioipofi ovrr«rii« sliippini; butifirM/^ ff to <lof% thr wdbjerrt haiv** any 
previously idnitifird «u»pirjoiJK rnrjtirUry traoatrMfjm' Rrvirw mafurMiu* artrvtfy 
Rrpoits (SAR) Currmry Transarlion Rrports (CTR.) and r urrror y or Monetary 
Irisburnnit KqMrts ((.MIR) Quay dir Fioanoat fjimn htfkjttrmttH Nrtwodt i 
(FinC.'EN) f iatrway dalahasr 


4.5. Ct-l Counifrtci lorism Disiiiptioos 

(U//TOUO) The disn^tioD of a (dedicated CT mv esti^Kio ocean wben a i e ttb e a Me lam 
enforcement or intelLgence acbon alters or impedes tbr oonnal aod effective operaaoea of an 
mdividuai, a group, an organization, or an eolerpnse engaged m terrorMm or actn'te« in 
preparation for. or si^iport thereof CT disnipboos may ordy be ebtmed m DT or IT 
mvestigatioiis and foreign police cooperatiOQ mallm relied to DT or IT 

4.5.1. (X") Disioiption Stiategs 

(U/TOUO) The long-term goal of a DT or an IT uivesugirtiOD is to drveiop esdUfcnce 
regarding all aspects of the leironsl threat Properh’ targeted re^xmses wiD gatiier afl 
intelligence pnor to conducting oven disn^on acdsities vi’htk maatfaimag ^ mmeiss of 
pubhc safetv’ The value of the intelligence collectKio in lelatton to die o*ate and u^uiksice of 
the threat and the negam e impact of allowing the sulqect s activities ic comsiEie ossi be 
considered when making the decision on when aod whether to <hsnipr a ^b;eci(t! 

(U/'TOUO) If the risk to pubhc safet>' is too great or if all sigmficsms lotelhgeoce been 
collected and'or the direat is otherwise resolved, tm'esniafiors mav. with program maoagemeni 
umt coordination and concunence. implement a disnipnoo ssra»gv 

4.5.2. (1*> DefiuitioD of a C ouaterteii orism IHsrapboa 

(U' TOUO) A CT disruption is an afBncumte actioot sj bv the FBI or a Mesal local or 
foreign partner in coordination with the FBL which neutralizes the thres posed b% aa FB! 
terrorism subject (i e , an mdividual a groi^ an argazuzaaoa or an esaerpnse * OoK one c?f&ce 
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Sf C RF l//N(H OKN 
(U) ( 'mmtntrtf (iitsin Polit y < lunir 


nuY claim tlic of a given iuiliirct as a slaltstiral at conifilishnirnt Any olliti otfirc fliat 

nukes a significant t oubilmtimt to die distufition (e g , setves a wajiaiit oi coniltuts interviews) 
nuy claim a disruption assistance as a vtatistn al arconii^ilishnienl In tUe event FOs disaftiee as to 
which office will clami die disruption the issue must lie irfeired to tlie a|>|NO(>iiate ("rD 
ptogiant maiugeiiinit section fur lesohibon ain) decision 

(U/.^OlIO) A successhil disruption strategy may employ a lange of tools to possibly include 
arrests depcrtalions. mteiciews oi source diret ted opetalioiis to effectively disnipt a subiecrs 
activides As a best ptac hce, when warranted, all subject interviews will s^X’afu'ally addiess the 
subject's actiMties and potential leauitmeut as a CHS Bxainples of some investigative actions, 
short of a cnntiual charge, that could disrupt a teironst subject incltide' 

• (U/'TOUO) A targeted inteivaew of the subject(s), 

• (U/TOUO) Sontre-directed actmties (e g . providing disiiifoimaiion) 

• {U/ TOUO) A media campaign to publicize activities, in accordance witli Office of 
Piibhc Affiurs (OP A) pohaes 

• (U/^OUO) Revoking an immigration visa 

• (U/i'FOUO) The seizure of financial assets 

4.5.3. (I") Disi option RepoHiiig 

Superseded by PD 052 3D . Gtn<Jimce for C/<Tfw;JTg Im-estiSiitn’e and Infelhgence Statistical 
AccoTf^Ushmmts, dated 6/30''2012. 


SI C Kf I//NOICINN 
/) ( Pfilwy C fUidr 


f>. (I ’) C^oiiiiM’ili^i riinsin Assc'Ssinf'fiU 

5.1. fti) of ( «iin»<*ti«rorivfii 

(U//F()UC)} hoi ihr policies and lulrs ilx’ t/mduct of as.srvsmrnts t*-fn to / ' / 

Seclioo 5 

(U//l"OIJO) A Cmaidian eutiy tuu^ br f otupleted oo all coiaaertmon-wn tnr tdrni.s isirli as a 
threat repoil or SAR even when a predicated investJF;)tKjci is epened In those iii!vj.»ires wt^ieie a 
predicated mattei (PI full mvestigatifm oi ET^ is opened a mmimjni amrjunt /f ^nrral 
informabon regarding the matter must be entered into Cjuardian and then die Ciuaidun lead mas 
be closed for the purposes of opening the PEfiill mvesbgation 

5.2. (1^ f >P^ ®f- and Basic Rules for, f.T .^.ssessmeDts 

(U//FOUO) FOs and CTD will ubli/e one of two inodek when cooductinp f'l a-sse-iirwiB i 

1 (U//FOUO) Guardian based (Type 1 & 2 assessments i 

2 (U/T^OUO) Assessment invesbgative file -based (Type 3 and Tvpe 4 assesanents) 

5.2,1, (XT/^TOl O) G^ardiaD-Based flMW 1 & 2 Assessmeotij 

(U/TOUO) Although Guardian is not an insesbgative file management system, tf does track aod 
manage threats and SARs during the informanon collectioo and lead imtigalion period as well as 
allow for the analysis of trends and patterns of threats and suspicious actmty' FOs Lerats and 
other FBI eutmes nn^ enter all reports of actual or potential terranst dneats and m&pecied 
teiTonst activity occurring within the United Slates or agamsi U S tuteresis abroad aMo 
Guardian 

(U TOUO) Geaerallv- items entered into Guardian are those actiiities. mcideras or obser^aboas 
(including ciUzen cotnpiaints) that may ha\e a nexus to lerronsm and mav be lailiTrd so detect, 
obtain mfonnation about, oi prevent and protect against federal enmes w threats to Ae BafimtHt 
secunty' 

{U'"FOUO) An FO must create a Guardian record to summanze the o^ure of all tetiomsci- 
relaled threats and or S.4Rs If the FO opens a predicated mvesOganoo subsequent to dir 
Guardian entry die FO must update the Guardian record within the Disposiboo^ tab az^ 
include the predicated investigabon file number m the closing diqx)s-nioGL Tbe Guardrail record 
must also be serialized into the FBI s cenbal lecor^eepm^^te^^vestiaa^e fik tx the 
predicated invesbgation Also, if the FO sends an the Strangle 

lufoimatioa and Operations Cenier (SIOC ). C T W'aick and the a^ofnraie program 
managenient umt regarding a terrorism-related threat, the FO must enter the e\ ei« or 
acti\atv uito Guardian (unless it is alreads' pan of an open investigaboii and ct was pc evioosJy 
enteied uito Guardian) 


flTi Alt uses of the word ' assessnaeut mas be preTUoied lo meaa an .A(Hj-Do3i-3U!Bsn-e4 Je^el ar ajwarsiiai"e 
acnvirs unless indicated otiieraise For ftiniier conies! on meamnsi. refe to ^ 
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SM Ki I ' Mil 

0 *1 1 iHttUnlriiiMtMit V i.tmfc 


(I f I M -1 1) I 1 1 I'fkli'i i>t>1 KiM'd limit .1 itiM nil Hiili il ( iiiln ^ rt)«iHh iii 

Ihmi'xrt i rttHt'v miiM W luifW^il^kni to |*ioui I iln' ( t Is i i oiilitb ntLililv «nl rii**iifi tlul tin 
tttti V tv lit I r u lit) ihoUh i»Iv Any nilinni.iiiMH tli4l i niilil ]<ji-fi1il v lli>' I MS 

(r I* 1 ihV iuiiim*) nuV ii+H In rnirn'il ui ( oitnliiiii Krl'i to itu i i ! S.[i im (• i>v 

tl’ 1 1 1| 'O) ISoi<i.itti iit44Ut*t-iiinil Aiiit lU i l at'lil ii fof (rii.iisliin .ivm'vmim'mIs Ids 

Itm*!! to tivr AK I Within llu* t I VV .iii It \iiv ttiKMi miHp ilimi I'ltiu *. m )Kiif nii il jn*h( v 

Moljiiiniv IimiikI hi > i.<o iiih.iit tv'-t wnn'iil h\ tiu' AH I oiii' l lir htoiwlil to tin irsiMirtvihtr 

c Jitlrtiiton ^ik 1 will i<s|mir a n vjioiiM- uid m inion to hiiiiM llu‘ im iiifiil inlo • imi|ili.uK < 

It ut I it m <1 tliMvimi l4ilv lofoitivt oi i I.uilv (In l^tiuiiU.iti itti itlitil willtiii .i ir^noiulilr 
tliiw'hdliir iSi u.',/ 'itf ,t» S' •. 'mm V'fi/ i ft fht- rv iNtt tiffit »■ Jhn ti \\dl 

N? i#i>i in thi' nn'iKj'it.Ui inxrslit'.MWi* tilr .un( .Mojiy (•tovnli'il lo ihr AK I file 

^ 2 11 i I v4> ti| /rill Suit li.\t’*AUM’nt I ili'v 

(I 1 OI 'Oi All Xtitiitii.iii -rv liMl ^ir fioi (niwritn) li^ pirili' .itfil iiivrslifMlionv 

will N* ii|iK'.nir<l to j no vtih .t'^vrs-aiirnl filr v^hui fuul iiiv}Hsvition ol ftw' (TiMiiii.ui Ir.tt! Hk^ 
mv' vnh .mil i-Mir will rxixi foi rai It .tlplu 

tlrvinLifo) ■' ( 

Av‘in»Nmeiit filt'v is siievilieJ ijitlic Hit Hi Sni li lib's shonkl t onliui ill iU’« iiitwnt-ilion ol 
ut\ ('‘•ijfjtivf .irtivitv ils iiM ot uivP’.Tip.tti\ e 1111*111011% rlr pmcT-iled diuifi'’ llir colusc 

ot :ut -WAOssinmi 

5 2 2 (T 1 0| t>^ VvM>%3inoiil lint' lisvilix v 1 ili* HiixiHi I Ixpt* ' oi 1x111*4 Asxoxxmfiitv) 

j V i'Ol 't ' I A'M*-siTimi inx t'viip.iux r lilr* air twnj ulins coininctinp aysessmrnlv lot ilireatv aiuI 
xiiliKnahthttO'^ ' Tx^ie t anti inlrllii’an *' oiah'^is and pl.umiiip tloinaiii .uialx^tv 

i lAiv 4 A'%r'>%iiir!i!.v s Src ni*. i Sn'tion Im furUid inii>rm,»iimi rfp.utUnp asscvsnn’ittv 

(1 1 i>l t>i Nol*' Ix^nr t jSiT ‘iixmls londiurtftl hv tirld iiilelliprncr prcup*^ (MOtiimvt 
I'v llie DkH . XI id thi 

i\ 1x41 t ^las^ifiralion musi be used when o^ieixine .\ C T 

isse-Antent e^aipative ai:lnah nuv iwi be dc^nunenled ui control 

lYW'^ see ) i ■' e npl .* ' ' ■ ■ 

^.4 il > Viiihottri'd Mftlioil' 

( s ‘NT « Aii uix e roeiliOfK oHlluieJ ot the i '' av lie ini' aiiiliciti-zed in in assessment 

mav lie iised w tll; llie exrqHiaj ol tlir opet iiioii of FBI C HSs oniside llie teinton.il ntiiSiliction 
of tlie t uiteij ST.it 1*^ 

^4 ill Bavt^liiie C olleeiioii Plan 

(I. It.tl I tt LXuiJi' an t •- .ni-riit m FO max • mtstder when it is re lex .ml practical and legallv 
pnniiE->-ible oiK+at t«ix? mr itJ'-my .v„;|ui§.-| m t ,i • • ^ xxnh tespeci to identilSine utfoinutiou 

for eii. h s-ibin.i ui a< mdai- e xxith t IT) s ha'cluie roMectioiii plan onihned ut >u''ro:fiia. t j‘ 
of thi' Kj 
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(If) t AftmiMitfifmttm P/4i» v C <»iKlr 


!(.9. ff/) (>fM>nlii{|; ■(If vfM' 1 4^ 2 Atuu^Arntmi 

(I ;//| 01 K>) rv Ii»ti4(iriri at 4 f vk J 4 7 by m Ki rm (>r «iei^ hf(/tU mm 

(tiiairli;iit l-mirul »MiJh Jliffri n nrj( fnifutird lo a tnpfi’Uvr f TIJ proi^wn tnmsa^prtjifM wm 
'OuN Vm k of fmnial tuAiU* ^tiaa dors nfj* rimaam- (hf n«r4 §m HH In krrp' 
mfoiiiird of liirrai uifrxrnafuai tn iMttJtdmw r wiAi * ■ of K# 

(li//F<fUO) Hit fumutif). at iftk bjurd aM * ;aim r q t amtt hr doamrmrd w4fl m H 

in arf ofcUntr wflh llir fiffXr 

5.4. (t ’) ( kisiui of a f I .Vwvtii»#'«4 

(VffVOMi}) I^Tof lo rkmof; a C^iiidiaii toMd m mr r mrs t afl rraanrcMr HUm mrnm V amir In 
rrarli a definitive r<m( lusioo a» lo the pcaratal dmrM of a n Ma4 %infa(wfi? or mmmi 
<ief'iifitY lhreat(s> povd by fitr Mibfrti m quesDoo [f a rUai and b^of ww ra hr rnair m 
to tlu* poiential diieai die (juafdaan mtuirni must Hidade m fti 'i1iyway.iri an mmaa of fm 
01 'No'* to the question trf^dmf imcus lo imoncm If daere s lan^brimi mknmmam matw 
a definiUve and drlef mmation aa lo die poleitfial doe^ dir mmt hr nart nf m 

' InciHitlijiiive ' Uwt of Ihr tncoiiclusive mmttmf. mam dm at the ii«r of doaaft 41 a»4aUr 
resources and mvestif^aive avenues have been mbauMed aod die PW fcmM mJhkt m 
conclusively detcimuie whetJier or not the wbyerr dors <h m dr fc*»r poae a d ae^ 

(U//FOUO) The closmj? of a Cl aasesoneat urveattfEmve fide ami fjEmam a dot ^mnatm 
concenuog any identified criminal vv4aiioiifs> or natnfial ancarMv dbRads; and m affiommv 
finding that tile file no longer serves an a^faonaed piapoce 


. t 




n 

nEcrit >oroRN 




0.8. OnJiiiF Invpsligalioiis 

(S'/REL TO USA, FVE’\’) Thf Cm.! program manages unique CT Internet invesdgatioiis Uial 
target leiroiists’ use of die Mrtual realm where a Web site or oiilme network of uidividuals is the 
target of the uwestigaiion or ulieie hiteniet exploitation is die primary investigative niediod CT 
su^ects niav use extrenust Well sites or forums to engage in the spread of extremist ideology 
and other terrorist activity Cooi dination with otliei CT prop am management units will occur, as 
necessary', to deteniime the sqipf oiHiate prop am management responsibihties. based on the 
subject’s Internet activities 

(S' REL TO USA FVE Y) The online targeting of an extremist Web site or online network is 
considered a sensmvT mediod Therefore, any infomiation regarding the targeting of such Web 
sites, the pubhc disclosure of which would reduce the effectiveness of the mediod. must be 
classified -SECRET' TIEL TO USA FVTEY/’ in accordance with NSICG. citation number JNV- 
20 Tlus appbes to details of the mediod that have not been made public even when use of the 
method in general lias been officially acknowledged 

9.8.1, (X,VT0l'0> Tvpes of Online Inv estigations 

(U^/FOUO) Outhned below are guidelines for when an investigation will be iLindled as an online 
investigation Questions and consultation may be directed to CITU wiien a determination, based 
on die foUowtng guidelines, cannot be made by an FO 

9.5.1.1. (S' REL TO I'S.A F\T\’> Extiemist For ums and C bat Rooms 

(S'* REL TO USA FVRM Online mv'estigations may be opened on suspected terrorists or 
tecrocisi poiqis that use Internet fcnums chat rooms, bulletin boards, blogs, servers, and Web 
sites to encourage and recruit members among English-speaking audiences in W’estem nations 
Cnr^ has noted a trend that ai -Qa’ida and its Sunm affiliates are attempting to reach non -Arabic - 
speaking Muslims who hvir in the Western world online, in efforts to communicate extremist 
jihadist pic^agauda m languages native to W'estem speakers Web sites and forums espousuig 
such propaganda contnbiite to the radicalization process and facihtate the recruitment of 
uidividuals into tenorist orgamzatious and cells Surveys of extreimst-ruu fcmims have 
detemuned that English-language fonmis liave led to the nse of tenonst cells entirelv widim the 
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Hi f if I l 

(mi r#f tarn \**Aity ( Att^ 


iKiifkis of WtMifjPin ludumh llwl (aif^rly »)d«*ix'rKirrA of offlirr *w froia 

ti;«(l]U(»ul U*7ifMr4 iil>lo;*ri 

y.S. 1 .2. (S//KJ r f I ’SA, I VT, V> foi UHi Adi«ak(i \ 

(%flKS'A. I C> USA k VliY) fmlir«r imt^tfryAttink nay J>r on adbsffasvJtof- oif 

fdiiJiriLs dial are lif'iiip maid Ui fiv ilitate uUnTaUimsi titsiijrt9l MJrjfty lo »jt tsidr pi s-^asf 
inveirttgatiijufi fwvi* dnrajn&tiated (he adirunistiatof & of rxtfwn^a firx jrrf* jr»- hy tM iUfuifjr' 
widiin forciRTi leiun isl ot >ianj/-aUwi» Iht adtniiiitUalor^^ »r m o^aitarl i^5Trjr«* loe^ cdlv 
and couiifjs, as wc-ll as dup u^mof leadfirsbtp of iCTrori-rt of F -'jcjws a Amini ^i r a^/lf^ 
inay mdijidf* indjvuJwals will) rjralf dial rooms buUeUn boards bio^ip and -mrs 

{S//RKL lO I'SA, f VT,Y> l omin Partkipaafi 

(S//RIiI.. TO USA . FVE Y) An investigation may be comidef ed an owbjt nr/r^^tisaiaiM wlea it ei 
priimnly based on a subject s online acmiHes and pxtiaps^tum wab esf'jr'^iiasl -'liaf 

looms, bulletin boards bbgs serveis or Wd> sites fonan pxiit:tp3et& naay ladede £»k-. 
whose prirnaiy activity includes the <fcv'eloprrjent of comxsmnKioai seojnf'y pmrtjc.es acd 
individuals acting as "virtuai couriers for terronst orgsmzaticKK by psesoms, or^sae irje'^^gr: 
among members or leadership Otiier mdisiduals not meeta^ ^jese cmena bel ejr^tai&id 
dirough the investigation of exiremist forums or ocUiae networics sanst be spoo off for 
program management by the ^ipropnate CTD program ma&a^nncitf umt and f O 

9.8. 1.4. (TJ) Use of O nlin e .Metbods 

(S//R£L TO USA Pw'EY) An investigation may be coGSfdcared an onhoe investu^aosi “adiKi k 
uses exploitation of the Inteniet as its primary melbod of imeUigence coCectioB or isvesaigaEioE 
Examples of such methods include the use of online CTlSs onbne coner? empk- f OCE > cr 
tlie electromc surveiHance of Internet-based ^cikties 

9.8, J . 5. (1*) Joint In vestigntions 

(S/'REL TO USA_ F\TY) An mvestigatira may be considered an cnlme sF.estig^jos 
opened at the request of a USIC or allied foreign partner to explon uarcnsfe ase cf ^ Isitnx^ 
As the majority of the world s Internet mfrastrucnire fmctudki^ Web afie bostsjg i k Issed as Siie 
Umted States, it is anticipated CTD ivili pursue oppornmities for EISA coilectaoo can U S -based 
sen-ers when requested to do so. and when it is ^sprofxiaiel'/ predicatai bv a USK or allied 
foreign partner. 

(S/ REL TO USA. FYE Y) Multiple agencies of the USIC . iiKrhjding the CIA and me Ivassanai 
Security Agency (NSA). have robust efforts to exploit tenmsts tKe c f tae Imeniet CTD 
actively engages these partners with intent of estabhshsng and psoperi'^- lereragS-f 
contacts to enhance FBI investig^ons against commoa targets in cffier to ^csktar? LaiansaTirc 
exciiaMes and leverage alhed resources for the FBI m the dc\ elofsacst ef >oiia -;S3er3a<30= CTD 
develops relationships wuh allied foreigii mteiligence and law enfz^cesiien: panaers ^ riisr.eri 
invohmg terrorists use of the Internet 
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SI TKI I MH OKfN 

(10 * niuHci ln(i»ii»iin INilu y trimfc- 


P S 2 (I 'M (H Ol I 'ni4|iir WckhIs foi I ISA t ullmlttMi 

iKitiiLil irf|Uitr*im'iilv of 
MSA 

Mih<Ytion 1 ' ^ 1 of llii’i }Hi Ihr follouin)* :«l(tilH)n;il WihhK f*i(K fifitic^ imisl Iw* lollowrd 
wlico j t niJ nuiuj»«l I'SK fMitim 1 ISA paii ifr t)fmp (n(Mrss«l foi •iiihiii»v*ioii to tire 
MSI 

1 fS 'Rl 1 TO USA TVl-V*) llu* MU dn l-UtUil (lyim -illy * t I lU SSA) for llit* f /Sl( 
p;ta k.»j?if* will pciinallv levTivf liie p;K kjpr vta Uw* roinrniinitvof inteiesc (( ()I)ch [Of* 
SHRIT (!>;)<• nwul 

’ (S R1 I TO USA, I VFV) Hie tlcrl.-u itiif nmst irviow llie pat kagr iiotuip tJie specific 
papes/iiilinniatioti letaleii lo (he TO lespoiisihlc foi (lie investipalioii, <«id wntl a TS 
e ttUil to the ies|iecti\T I O frt|uesfinj» a liiiuled Woodf* foini fof tfie sj>ecifjc 
pape^i uiJtTniwitHini eoiitained m the TISA package related to the FO s 
lilt el 1 1 pence ' u i foi niat i oo 

1 (S RTL TO USA TATikTi The TO mnsi re\iew the ifie<l pages/mfomiation verify 
that llie facts are acciuate and coiii|ilete a Uuuted Woods fonii with notations staling the 
page nnmhei and tlie specific paiapiaph and'or infomiation venfied The l imi ted Woods 
fcHBi must siibsequenllv be sent lo tlie CITU declaiaiit 

■1 (S RFL TO USA FV't’V') Hie mfomialion descnlied abose must be maintamed m tlie 
FISA Acauacv subfile estabb sited for the captioned investigation wheie the 
mteUigeiKe/mfoitnation was derived The inforniatioti must contain a notation on which 
FISA package it verifies 

(T T OLX)') Upon completing tlie four steps above. FOs tnusl 

• (U 'TOUOl Pnni tlie e-iiLiil requestmg the Imnted Woods form 

• fU TOUO ) Print the specific pages'uifomiatiou from the FISA package 

• (1: TOUQ) Attach copies of die documents used to venfy die FO s mfonuation in the 
FISA package 

• lU' TOUOi Atrach the signed ortginaJ Woods form 

• fl- ' TOUO) Forward the package to the CTR* who will arrange transmission to rX)J s 
NSD Office of Inielhgence (Op 

o tf.3. (T f Ol O) Joint C TI) C vt>ei Diilsiou (C vD^ In' eshgation'i 

( S REL TO USA F\E\X Due to the potential for overlap regarding mvestigations targetmg 
len onsts use of die hjiemet CTD and CyD have iniplemeofed the follow ing procedures 

■ tS REL TO USA FA'S A") An FO csTiei squad must maiiediatelv notify die FO CT squad 
upon opening a Computer Intnisions - lutemational Terronsiii (T88J investigative 
classification) PI oi full investigation The CT squad SSA wdJ identify a CT speaal agent 
(SAi to iniTiate an appiopnate. parallel CT mvestigation and to sene as a CT POC The 
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Sr/ l//NtfllOKN 
(tj) f 4rtmttrtlrfjtniWt y f #uvt^ 


X wiH PMWilr (J»r t/( 41 IJ futtnruii V* urily Ujf'A’i to iiAiFfS* fcr frf 

irtvr«lip^lli(jfi 

• (S//KI-J- IfJ USA. FVhY) If a Cf rytm jrtiytty «fi«4i « 4 ^ I V 

tiivntUfVidOM ifif C "I SSA fiJUSl f 0aSMi tfjr cybn SSA 7V ryljrr SSA wrfl rt«> 4 

rvt)fi as a WX Aftw rolbbnvatiftf, ifar ^yhn v^u6 witJ 'Vt^irw#* to wfasf 

if any l^ir inv<r^^;itojfi iiivolvfY trrionirt »ilf imscio artivsty and opnj a /ftSU 
iiivrsti^iori if apprijpnato If dirrr m net uitnmtM artivXy bui a nerd lor tntifKiira} 
a&ststaiirr rxinte. tin* CT rquad may levfuf^ that (far ryfan tquad a fT trimtfM 

Suf^vt to Cl*) tnvrKtij^abon 

* (S//RIiL If) USA. FVEV) All 352 iDV«tigation!i involviag paaOrl ffD 41 5 
mvrqttf^iorLs muvt mrluck 10 Ihr dictrifautioa CxMoieTtnrariaBi Aub f*‘XS<".rn. 

C yber Divi^iori. Attn C^SS Each <^ofijnunKXboci bmM be filed m betfa Ifae ISi and 4 J 5 
invest] gabons 

9.8.4. (S//RLL TO USA, fAXV) Oofam* I ederriww »»d KIMfVf Operattowi 

(S//REL TO USA. FVEV) The requiremeirts set foffli 10 ^ 6 of dn* r*0 re^dntf 

national security undercover opcratioiK apply to all onliae UCO% wrhKimg die ^»e1 laloo 
N^onal Imtiativc (NTNI) (refer to vubseciio o 9 8 ^ of (fair PG/ 

(S//REL TO USA F\XY) Any IT inv'estigation ufalmiif die andCTcofV^r nartfaod to 
online extremists and/or extremist Web sites, mcludinf. but act itrarted to. fonsK dsat nxxm 
blogs and other Internet technologies must be coosidered a senfirtne omanstanre mti wdL 
therefore be a Groi^ I UCO Inni^dioa of CT onlinr UCOi must be coonfas^ed wtdi CTW. 
CTUC. and the NaUoaal Sccunty Law &aadi (NSUB> Such oofane tX'Oi musi be rs-afaiased ^ 
CTTTJ and CTUC for inclusion into the NTNI (refer to i 9M 5 of PG> 

9.8.4. L (l^) Deconffiction 

(y/REL TO USA FVXY) Ounng an anfane msestigatiOD it » unaper^e ^ FO asd GTD 
implement strong source deconfliction measures liBufficacat deconflacuon. coeafatord aHM the 
di^e nature of the Interact has previously resulted m resources be«^ wasted by 
or coliectmg on rei online identities (i.e, undercover employees [UCE]' OCX^CKS«; ute har.e 
already been mvestigaied by other FBI offices, the L’SIC and or m alfa^ fbreigEi partner 
Increased collaboration and coordanatioD regarding csiline UCEsrOCXs CHSs is necessarv to 
reduce the problems of self-tnv'esugation aid dupheabon and to odmee toe FBI 9 ovcral! effbrr. 
to counter tenonsts use of toe Internet 

(y 'RET TO USA. F\XY) CTTU is the lead umt witom CTD to decoc^lia aD usaUert pertaaiE^ 
to online identities The Net Talon diabase (refer to sttoseciiog 9.a i- sd tois ?&/, maaxaaaed 
and operated by CITU identifies decooflimon nctsfe fee toe tsifaeifuus online aisases aod 
momkers of FBI UCEs. OCEs CHSs and exnemtst ^'eb sites 
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9.8.5. (ll//F0l’0) N^t ThIwo Niiliunjil iDiliative 

{S/-REL TO USA. ¥VBY) In May .» 008 . the NTNl was a|ipiove<i by tlie (’TO 'IV Nl’NI is an 
onltne imdcicov'er national mitutive constructed l» stiatrgii'aity fcxiw opaations (using OC:i:s, 
UCEs. and CllSs) tai grtme taronsls’ use of the Intenwl 

(I.I//FOUO) For fiinhci details regarding the Net Falou Piograni, refer to SertouJ 7 of lliis PCI 
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10,6. (1,7/FOl'O) OnUne Inv^stigatioDs 

10.6.1. (IV/TOl'O) T>'pes of Online InvesligaHons 

(UATOUO) Outlined below are guidelines for when an investigation will be handled as an online 
inwstigation Questions and consultation may be directed to DTOU w'ben a detennination. based 
on the guidelines below, cannot be made by an FO. 

10.6.1.1. (UATOUO) Extremist Forums and C hat Rooms 

(U//FOUO) An hn^tigation may be considered an online investigation when a suspected 
extremist oi tenorist group uses Interaet forums, chat rooms, bulletin boards, blogs, servers, and 
Web sites to enc<»iragie and recruit members, and the investigation is pnmarily focused on the 
online activities of the extrerms^s). Web sites and fonuns espousing such propaganda may 
cocttnbute to the radicalizatioa process and facilitate die recruitment of individuals into domestic 
extremist organizations 

(LV/FOUO) An in\*estiganou may be considered an o nlin e investigation when the matter targets 
the adrmnistrators of Internet forums. Past mvestigations have demou-strated the admimstrators of 
extremist fonuns are often key facihtatOTS wi thin domestic extremist oiganizabons The 
admimstrators are often m contact with senior leaderslup of the organizations or are members of 
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die offvuii/aUons diniisrlvcit Fofimi juhmni’iUAtoi^ rn^iy nte hi^ whftiirsi^ that 

looms. Iiullrtin twaids. Work, srrvm aivl WHj Mtrs 

10.4.1.2. (IJ//FOUO) f orufn Parlii ip^ulx 

(U/Z'FCJIJO) An invesbg^Uon ruay br ronsidcfwJ an tmimr uivrtliRatjfjn wHmi fee miMa n 
[niinanly based oo the subject's onJinr activities and pacrticipation wiiii nctmni«l fiofiinis dot 
looms, bulletin boaids. bki^, savers, of Web sites Forum particifHKils may incbide mdivi duals 
whose pf iniaiY activity includes the development of corormimcatKins ver unty pi a/lH ei m 
individuals acting as ' vutual coufias" foi domestK extremist argaiuz;diom by posing onlinr 
messages among membas oi teadaship Otha individuals not meeting (fcese o'ltma 
identified through the investigation of exlrauia forums or oolme artworks will be 
for program management by the appropriate FO and DT progran nuKagrxneoi unil 

10.4.1.3. (UZ/F OLiO) Use of Online Methods 

CU//FOUO) An mvestigatioo may be considaed an online mvestigation when d iocs expkirtalioii 
of the Internet as its primary method of mteiligoice colkcbon or investigatioo Ex^nples of such 
methods include the use of o nlin e sources. UCBs, or electromc surveillance of foteroet based 
f^ihties. 

10.6.2. (U//FOUO) Joint CTD/CyD Investigations 

(U//FOUO) Due to the potential for mrol^ regarding mvestigalions taagetmg extrcnusl use of 
die Internet, CTD and CyD have inqilemented the following procethires. 

• (U//FOUO) Upon the opening of atfaa a Computa Intnisioos ■ Domestic Taroiisn 
(28SK classification) PI or full mvestigation. ^ FO cyba squad mist nnmcdiatelv 
notify the FO DT squad The DT squad SSA will identify a DT SA to Kiitiaie an 
^ipropnate parallel CT mvestigation and save xi a DT POC The POC wiH ensure the 
levaaging of ail national secunty tools to address die targets of the mvestigfiioQ 

• (U//FOUO) If a DT squad detoimnes cyba activity exists m a DT mvestigatioo. the DT 
SSA must contact the cyba SSA. The cyba SSA will then assign a cyba agon as a 
POC^ After collaborating, the cyba squad will detonnne to what degree if any. the 
mvestigation mvolves cyba terrorist uUruston activity, and open a 2SSK mvestigation. if 
^ppropnate If thae is no mtiusion activity, yet tedniKial assistance needs exia the DT 
squad may request that the cyba squad open a 2S8G (Technical Support to DT) 
investigation 

• (TJ/TOUO) All 288G and 288K mvestigations involving parallel DT mvestigatioos must 
include in die distribution: CountataTonsnL .Attn DTOU. and Cyba Div isjoo. Ann 
NSCU Each communication must dual c^ion the investigation ID mimba to mchide 
both die 2S8 and the appropriate DT classifications 

10.6.3. (X.7/FOI O) Ouline Undercover and HITVIEST C^eratious 

(U/TOUO) The reqinremails set forth m subsection 10 of this PG tegardmg DT undercma 

opaations apply to all onlme DT UCOs 
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Si :c Kf; i7/NOI C>KN 
(I/) CoitnleitFnoiisiJi Policy tiujifc* 


(1^ DwonllicHon 

(U/'TOITO) Dunng an onluie luvrstigabon it is unpet atiw that tlif FO and iii^lnncKtl 

strong sowrrp <k^onflicbon tneasurfs InsiifTiaail deconiliclion, combined with tlie diffuse 
natute of the Interoet. has pievimisiy resultrd in resouicos being wasted by investi^iting or 
collecting on FBI UCF^/OCEs/CHSs who liave already been investigated by other FBI ofificcs, 
the FJSIC. and/or alhed foieign partners Increased rollaboraboii and coordination legaiding 
online UC'Es/OCEs/CH&i is necessary to i educe the problems of self-mvestigation and 
diipbcatiofc and it enhances die FBFs overall efforts to counter terroiists' use of tlie Inleniet 

{U 'TOUO) DTOU must utilize the Net Talon database for deconfUction of all DT online 
mvestigatJOiLs. Refa to su bsection 17 5 of this PG for mofe mfonnation on the Net Talon 
Database 
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11, (li) J>ri’ori.s< WalrhlisHiig 

I tJ. (1J> WatrlilKliug Ha\i(s 

(U//FOUO) llic USCf rnaintaiii& a coiwilirlatpd bsl of u^itvithud% wbo arr koowu or vtnfjrrled of 
being tefTOfists 'Hus list, known as tiie leiionst Viferung I> 4 tabase is mainLuDejl by the 
Teriotist Soeenuig Ontei (1"SC) The submission of as mdi vKln^l to nmiAt’nm r. Tntjfkfv Mafm of 
and appiopi late removal of the records within the ISDB is lefnfred lo as watchhstmff 

{U//FOUO) The USG’s consolidated tetfonst walrhlist is a cf iticjil tool for icr^rraav n ; at V *> 
borders and ports of entry; (2) passport and visa applicants {?>) an 'rah pa'.sengeTi. and new 
members, (4) during federal and domestic law enforcement encounter', or {\) '>thrr apprr.»ved 
activities that have a substantial bearing on homeland security The watcbJi^s f ari qoi'ddv and 
accurately notify the user that he or she has encounlered a known or 'iosper'led terrorLSi I'K-ST; 
and it [novides instruction on how to re^xmd to the encounter 

(U//FOUO) TREX is responsible for ensuring aU subjects of FBI tcnoriiio ur.esUgatic^ are 
appropnately nomiuated to. and/or removed from, foe TSDB and all eb^ble supporting 'i>'5*«Qa 
TREX also ensures that records m the TSDB and supporting systems arc modified as 
c^ipropriate A no mina tion is accomplLsbed through the subnnssion of a waichbst nccnmatmQ 
modification, or removal to TREX (refer to sufcv:^- lOC t ^ of fins PGj 

11.1.1. (U) The TeiTOi'ist Screening C enter 

(U//FOUO) The TSC was est^hshed m 2003 by HrTmela'^ Se -nt" 
fH.SPD-61. which directed foe establishment of an organizatroa that would consobdaie foe 
government’s approach to terronmi screemng and provide £or foe appro]Biate and la^'fui o€ 
teiTonst mfomiation in screemng processes. The TSC is a multiagency eniiTs' adnoinisiered by foe 
FBL Avith foe mission of facilitating and assLstmg m the protcctKic a^inst tenonsm by 

• (U//FOUO) Coasobdatmg foe USG’s approach to tenons screemng 

• (U//FOUO) Providing for the appropriate and bwfiil use of terronst identiTy mfocmaiacn 
m scfeenmg processes 

• (U//FOUO) Maintainmg consofidated. tborou^ accurate, aixl current infonnalioo on 
teiTonst identities 

• (U//FOUO) Sharing information globally and between foe federal, slate, local temb^xal 
aud tnbal law cofoicemeut and intelligence commiuuties 

• (U//FOUO) Conducting these actnUies m a maaji»i consistent with the U.S Constrtutaon 
aud applicable U S, laws protectmg pnx’acy and cisil Ubeities 

(U//FOUO) To ensure the TSDB contains the most foorouglL accurate and current mfonnatiou 
TSC personnel review individual TSDB records throughout the watchlisimg process, tnclufong 
but not hmited to. at the tune of ncmiuation and or modificauc^ at the time of a screemng. 
encounter vvifo a watchlisted subject, and at the time a watchhsted sulqecl sninmts a redress 
mquirv’ witli a screenuig agency 
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(U//TtH)0) ITjc I'SC iwvivrs "itlnitifins’' of KSTb fimn llir Inllowiiifi two tunurrs (I) llw 
NCTC' trp»(liiip. uitriiKiboiul twiwnsls and 0) djirt'tly fnwn Oif I Ht irpaittinp, dotin^lu 
imofists Idrtilifins inrliulr biopiatihu al infcNiiulion siuli jk date ofliiiUi tlX)ll) idair ofbiitlt 
SSN, oi biotiintie mfiiNTiuhoii smJi aJi fittotopiaiilLK oi fiiipei|Hitils llw* ideiitiftris of Husjiecli^l 
tmonsts m tlic TSDB ur dcxiiHHl ‘Toi OHii lal Use Only (f OUO) .uid air foi wait hlistmp, 
purposes cmlv 

11.2. C1\il 1 dbrilies 

(U/^TX)UO) Tei piotm civil libnlies and piivacv, evei y watchlislinp tunninatioti imisl niert tlw 
watclilisimg standaid (rein to tioti 1 ) 1 of tins PG) Tlie walclilistuip of individuals bailed 

solely Ml activides protected by tlie First AiiHiidiiieiit, on the tare, ctluucity national onpui. or 
leJigjon of the subject, oi fm political m letahatoiy pui|K>ses is pi ohilnted Any piotwsed 
nomination foi watchlistmg tliat involves a SIM {lefei to tlie DIOG section on sensitive 
investigativT maners) will be bioiigjiu to die attention of TSC. CTD, OGC, and DOJ officials as 
appropiiate FBI peisonnel must stiive to ensuie tliat the data subuutted ts acciuiUe thofougli, 
and ciment Also, personnel must ensure watchlist recoi ds are updated on a tinielv basis to limit 
any potentia) adverse consequetKes to watcidisted mdis iduals and to reduce die potential foi 
nusidentification 

11.2. L (XU SPFR Status 

(IJ//FOUO) A subject’s USPER status does not piev'ent die subject’s tioaimalion for entry into 
the TSDB In accordance widi die TSC's ff^atchUsimp Guidance.. Afarch § 3 15. 
iKKninadons of USPERs must be made based on mfonnation of known reliability or where there 
exists additional cosnoboradon or context supportmg reasonable suspicion To meet these 
requireiuents all FBI nonunations are reviewed by TREX and TSC, which confirm that the 
watchlisting standard has been met Wlule TSDB includes USPER subjects. USPER status may 
affect a subject s export to a particular supported system 

] 1.3, (C^ Watchlisting Standard 

(U^fTOUO) In order to nominate a subject for entry into the TSDB and aU eligible supported 
systems, the FBI must ha\^ a reasonable suspicion to believe diat the subject is a KST or an 
authorised exception To meet this standard, the FBI must have “articulable” inteUigeuce or 
infotmatioa which, based on the totality of the f^s. and taken togeiiiet with rational uifereiices 
from those facts, reasonably warrants a determnjation diat die subject ts known or is suspected to 
be (or has been) knowingly engaged m coudua constituting, ui preparation foi . ui aid o£ or 
related to. tenonMn or teironst activities There must be an objective, factual basis for the 
nonunator tobebeve that the mditidual is a KST Mere guesses or hunches” are not enough to 
constitute a reasonable suspicion that an individual is a KST For additional detailed infomiation 
on the watchlistmg standard, refer to die TSC’s ITatchiistTfig Guidance. March ^013 or its 
successor 

(U TOUO) Tbe DIOG ^thonzes the initiation of a PI based on any “allegation or infoimation ’ 
mdiicative of cnminal admty or threats to national seauity In order for PI subjects to be 
walchhsted the alle^tion or mfonnation used to predicate the ms estigation must also meet the 
reascmable su^ncion standard for watdihstmg The DIOG authorizes die uutiation of a full 
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SM Hf 

(( /) < MuilrrtrfHXimi h^tAtty fAwIt 


invciilifvilKnt tnard im 411 "artruIjAip furtmi twin" of jimmUc rfnMsd md m/Ktsed #»«* 

;ir livily Jtir aitiruJafjlr . iLvIual iiKr<l kf rjpt-n m tnu/imu faff nvtnkftf^K i/tr* mni^ far 
iriiMiru(>lr «ii«pi( uiri sttauthud ftx 

(U//tOVO) SiJjjrt'te of ( juutfdtjtf) dmnmttrM* j»€ 00* to bp vifafn^pil to JV£X tm 
nof fnay tPirtif isl fftfup of of ji^anx/Jtion nmms he fMMuateti for mtry Mio far TSf]^ 
Nofniiutioru nuy not tr hased cm vxmcp ipportuif (fanned uotpIiiMp fSmpieaamk Mitvltf duot 
Uiai doc^ not nsr to tfie IpvpI of a fememMe ciMpfrjon of m wadmmai auepktm m net a 
suffirimt basi« to wixtriOist an mdividuai The ob^rrUvr farmal boMi bg/jBg a wperSt 
individual to tmorism of Imoiirt artfviUn n alio knonm as parbnibnzrd <far(^aiory 
infoimatian whicli u die basis for adfanf; far aot^ecl m FBI laynAfpliOB to far jy[M 

(U//?OU(J) In fiiakifig a reasonable susptctoo (fatrniBnatsQD far FBI may rcxm da ^;cfanvK«ai 
indicators known to be associated wifa particular known or Hwpecaed tenoraK m fae paaf Ifar 
need to protect civil liberties bowevn requires faat sucb aadrcasort net be ;ed|^ m MO t H i Oft 
Efach uifacator must be viewed in the coolexl m adnrii il occws and conndercd la confaosfaflB 
with all otlier known information to ensure th^ any norntnatioc bated m wbofa or m part cm ffwa 
behavior comports with the standards set forth above Exaoipfas of torar maimf faefanmi 
mdirators include 

• (U/^OUO) Attendance at tratoin|! camps known lo the USIC at faofataia^ tenoiiai 
activities 


• (U/'TOUO) Attendance at schocds/mstitutioDs idenltfied by the LTSiC as wachig; eaMewmfi 
ideology, including the justificatiCHi of the unbrnrhil use of sioleace or violeHl exIienDiMK 

• (U//FOUO) Repeated contact with individuals identiBed by fae USiC as wariwiy gr 
espousing ideology that includes the justihcanon of ihe laalawrfod use of viofeace or tnolas 
extremism 


• (LV/FOUO) Travel for no known lawful or legtisnate (xiipose to a locna ai tenor at 
activity 


(U/(FOUO) Addibonal gtudance and specihc mvesnpation examples far the 
standard can be found on the TRFX Int ranet site and on die TSC fcgiangt sate 


11.3.1. (U) Exceptions 

(U/T^OUO) The Nabonal Secimty Cotmal bar appiovi^d reveial mstances m wfadk an infaundeai 
who dors not meet die reasonable susfuaoo standard may be ooesaaatod to some of far TSOB $ 
si^jported systems (refer to the TSC s fTatchiumf Cajdanca Msrrh § 3 14) A§es^ 
must coordinate with TREX to determine if a gives mbvidual falls wnfam the lanffs ofooe af 
these exceptions 

1 1.4. (Xy TSDB and Suppoited Systems 

(U^'TOUO) The TSDB suf^xms federal state, loc^ iermonal aod irfaal amhonnes and oci^bi 
foreign governments effom to screen for KSTs throng its exports These sfaornstes me faev 
s>'stem.s to run name checks against TSDB data The TSC teetdarly ptov^es a p d^ed sefesf^ M 
TSDB data to several systeim 
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} 1 .4. 1 . (I ’^/l Ol D) Kiionn i» Siivim*! I^<I I ri i »i 1st I ik (KS I 1 ilr) 

(I Hit KS 1 file w bv llii* IM aiitl liciiiml wiliim IJk* N( K ' tLiUluM' tlur KS 1 JiU- 

»> ( ntiKKm'il ot inliifTiul It'll trblrti 1o llie ulniltUc!^ of tmlivuliuilii liiunvn tn to luvr 

kTKnvtii|?lv mpji|»€*d iii iomlmi rtinstiinivii}* (Hquiiiit* fin m ant of of irbirtl lo iiitniMliiHul oi 
tlotivstir irtitnismoi imonsl 

l’XHK>) Hit KST hie was ttnninly known as llif Violent (laiip. and I'nioiist 
pani/Ation File (VGTOn Ttif VC 1X)F was split into two sepaiale files in August 
^*009 die Gang file and the KST file 

114 1.1. (H’Ol KST llanclliiig ( odes 

(I' FOl X)) Each record ui tlie KST file must be assigtied a handling code, as follows 
1 1 4 l.l.l. (IT) Handling Code I 

(IT TOUO) Handling C.'ode I is for uidividuals foi whom there is an active federal arrest warrant 
in die NCIC Wanted f^rscms File File wan ant nimibei must be included within the walchhst 
irquest If a subiect is watchlisled with Haudlmg Code 1 and the arrest warrant becOTies uivahd 
the case agent niust subnut a new ivatcldist request fomi to TREX to update the recoid The 
following banuei a^ipears tn the KST file wheu a Handling Code 1 is encountered 

•”LAW ENFORCEMENT SENSITIVE INFORMATION 
WARNING - APPROACH WHU CAUTION 

THIS INDIVTDUAl IS ASSOCIATED W’lTH TERRORISM AND IS THE SUBJECT OF AN 
ARREST WARRANT ALTHOUGH THE WARRANT MAY NOT BE RETRIEVABLE VTA 
THE SEARCHED IDENTTFIERS IF AN ARREST WARRANT FOR THE rNDRTOUAL IS 
RETURNED IN YOLU SEARCH OF NCIC, DETAIN THE INDIVIDUAL PLFRSUANT TO 
YOUR DEPARTMENTS PROCEDURES FOR HANDLING AN OUTSTANDING 
WARRANT, AND IMMEDIATELY CONTACT THE TERRORIST SCREENING CENTER 
(TSC» AT 

iSti« S72-!>OOl FOR ADDmONAL DIRECTION 

IF AN ARREST WARRANT FOR THE INDI\TDUAL IS NOT RETURNED. USE CAUnON 
AND IMMEDLCTELY CXJNTACT THE TSC AT (866) 872^9001 FOR .ADDITIONAL 
DIRECTION ViTTHOUT OTHERWISE EXTENDING THE SCOPE OR DLTIATION OF THE 
ENCOL?NTER. IF YOU ARE A BORDER PATROL OFFICER IMMEDIATELY CALL THE 
NTC 

L'NAITHORIZED DISCLOSURE OF TERRORIST WWTCHUST INFORMATION IS 
PROHIBITED DO NOT ADVISE THIS INDIVTDUAL THAT THEV' MAY BE ON A 
TERRORIST WATCHUST INFORMATION THAT THIS INDIVTDUAL MAY BE ON A 
TERRORIST WATCHLJST IS PROPERTY' OF THE TSC AND IS A FEDERAL RECORD 
PROVIDED TO YOUR AGENCY THAT MAY NOT BE DISSEMINATED OR USED IN ANY 
PROGEEDINO RTTHOUT THE ADVANCE AUTHORIZATION OF THE TSC 

‘♦'LAW ENFORCEMENT SENSmV'E INFORMAHON*** 

(C T'OUO) WHeiiever a Handling Code 1 sub|ect w arrested, the case a|ient must modify tlie 
KST 'Nt IC record to change Haudlmg Code 1 to Handling Code 3 

11.4 1.1.2. HY Hriudlitig Code 2 
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(( JJ C Yjtodnlnr/rfHfn P*Au y f ft/ifU' 


(U//l'OI/()) fiMulUnff Cfidt t w fen inefavidiui* f« wifnnrj «» wfH * 

drlniiirt )l iJif indivieiiinl ft rwiiuiilrfM by law ft nuy nho f/n 

fen wlujiTi linnr i« 4 tralrd Mrrwl w^ima mid Unjr i« tfj ‘in' Vj^Ip? 

Uj siiUrilum 1 1 ) A rrvirw of irdtlbf^r iwrorfb iiifjsl fmmjtdf nrnTm^ww ^j=# 

iiilo tJje KST fitf witfi this \mvd\isip_ rrjdp To mt HandJaif f ^ 2 » trvirwr , 4^ f-n 

lrp;aj ^ufTn inif y by Ixilh Ibe C:iX' and ifar fXX arf- ticqfmed Tht l^aw i,ais 

cooidmation witli tfic NSIJJ. mJf pfovidr lur-b afjfnoval fi* fXX. TV b»v^fT . 

Ill ifir KS7 fjlr whra a Hafidlfo^ Codr 2 u itiroisttr^ed 

••LAW ORTEMfXT SENSimT INFORM A TTOW*** 

WARNTNO ARPROAOf WITH CAUTION 

THIS INDIVIDUAL IS Of INVESTIGATIVI: ffTTEXEST TO JAW ENKjlU:Elffi<rT 
REGARDING ASSOCIATION WITH TERROWSM AND TWKE HAY Bt A DETASlEt 
AVAILABLE FROM THE DEPARTMENT OF HKNySLAMD *a^nY E0» THBI 
INDIVIDUAL 

IMMEDIATELY CONTACT THE TEJEJUMUSTT SCREENING CENTER (TSC? AT 
(866) 872 9001 OR. IF YOU ARE A BORDER PATROL OFfKEJt IMliEDUTRLir CALL 
THE NTC TO ASCERTAIN IF A DETAINEft IS AVAILABLE FOR THE {MDfVSmL AJO) 

TO OBTAIN ADDITIONAL DIRECTION PLEASE QUESTION THIS atDf Vmsm . lO 
ASSIST THE TSC IN DETERMINING WHETHER THE WDTvTDUAL ENUJUNIHSD B 
THE SUBJECT OF A DETAINER WITHOUT OTHERWISE EXTENDING Tffi SCOPE O* 
DURATION OF THE ENCOUNTER 

UNAUTHORIZED DISCLOSURE OF TERRORIST WATCHUST WS-OOtATiOH B 
PROHIBITED DO NOT ADVISE THIS WDIVnXJAL THAT THEY MAT S Cl« A 
TERRORIST WATCHUST INFORMATION THAT THE INDfVTiX'AL MAT K Oil A 
TERRORIST WATCHUST IS PROPERTY OF THE TSC AND IS A FEDERAL R£CO?D 
PROVIDED TO YOUR AGENCY THAT MAY NOT BE DISSEMINATED OP fSID Rtf AWf 
PROCEEDING WITHOUT THE ADVANCE AUTHORIZATION OF Tiff TSC 

•••LAW^ ENFORCEMENT SENSTmT WFORMATRON— 

11.4.1. 1.5. Handlins C ode 5 

CU//FOUO) Handling Code 3 is fa mdfMduals wt» hav« bees waldbfasied. bui do me?? ^ 
additional mtena fa Handling Code I a 2 These leconb nosi coKan a fint inMe Vn 
and year of buth ^ The follcrwing bazma m the KST file wfaeo a Haniftng Co^ I 

encountered: 

••^LAW ENFORCEMENT SENSITTVE IPffORMAHW?— 

DO NOT ADVISE THE INDTVTDUAL THAT THEY MAY BE OK A TERRORfST 
W'ATCHUST 

CONTACT THE TERRORIST SCREENING CENTER <TSC- AT 

THIS ENCOLTVTER IF THIS W’OULD EXTEND THE MTOPE 02 OF THE 

ENCOLTVTER CONTACT THE TSC BaJEDlATILY TSEREAFIER IF VO. .J2 A 
BORDER PATROL OFHCER IMMEDUTELY CAU THE NTC 


^ (U' FOUO) In voine «ngeDf cueuBstsBces. i ate* ime bit a -i 

with TREX 
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Ai rrMPT TO OBTAm surncmm idi-ntifyino informahon duhinci niii 

FNCXnJNTFR wmiOlJT OTHERWISF H>fnvNDlN« THl- SCOEK OR IHIRA110N Oh 

nn i:Ntx>UNTHR, tx> Assisr thf. tsc in df.terminin(} wtr; tm-R oh not iKt- 

NAME OR IDENriFTHRtS) YOtJ QUliRIFD Hl lONOS TO AN INDIVUJUAI, IDENTTl-n-O 
AS HAVING possible: Trt:S WITH TERRORISM 

DO NOT DfcT AIN OR ARREST THIS INl^lVIOUAL UNITISS THERE IS EVIDENCE Oh A 
\TOl ATION OF FEDERAL, STATE OR LOCAL. STATUTES 

UNAUTHORIZED DISCLOSURE IS PROHIBITED 

INFORMATION THAT THIS INDlVtDUAl. MAY BE ON A TERRORIST WATCHUST IS 
THE PROPERTY Oh THE TSC AND IS A FEDERAL RECX)RD PROVIDED TO YOUR 
AGENCY ONl,Y hX)R INTELUGENCT AND lE-AD PURPOSES THIS RECORD, AND ANY 
INFORMAnON CONTAINED WITHIN IT MAY NOT BE DlSaOSED OR USbU IN ANY 
PROCEEDING WITHOUT THE ADVANCE AUTHORIZATION OF THE TSC 

WARNING - APPROACH WITH CAUTION 

•**LAW ENFORCEMENT SENSLIIY^ INFORMATION *** 

11,4.1.1.4. (I') HaDcUiDg ( ode 4 

(U/.'TOUO) Handlmg Code 4 is for mdmdiials who have beeti designated Mihtary Detainees 
(MDLDETs) These individuals liave been vetted by tlie Dqjartnieiit of Defense (DOD) as 
persons detained by Coalibon Forces m Afghanistan, baq, ot Guantanamo Bay and have been 
shown to have no known nexus to terronsni These records must contain a first name, last name, 
and year of buth The following banner appears when a Handling Code 4 is encountered 

♦••MESSAGE KEY QWT SEARCHES ALL NCIC PERSONS FILES WITHOUT 

LIMITATIONS 

•••LAW ENFORCEMENT SENSITIVE INFORMATION* *♦ 

DO NOT ADYTSE THIS INDIYTDUAL THAT THEY MAY BE CONSIDERED A PERSON 
WHO MAY POSE A THREAT TO NATIONAL SECURITY 

CONTACT THE FEDERAL BUREAU OF INVESTLGAnON (FBI) AT (866) 872-9001 
DURING THIS ENCOUNTER IF THIS WOULD EXTEND THE SCOPE OR DURATION OF 
THE ENCOUNTER, CONTACT THE FBI IMMEDIATELY THEREAFTER IF YOU ARE A 
BORDER PATROL OFFICER IMMEDIATELY CALL THE NTC 

ATTEMPT TO OBTAIN SUFFICIENT IDENTIFYTNG rNFORMAHON DURING THE 
ENCOLTSTER. WTTHOUT OTHERWISE EXTENDING THE SCOPE OR DURATION OF 
THE ENCOUNTER. TO ASSIST THE FBI IN DETERMING WHETHER OR NOT THE NAME 
OR IC«NnFIER(S) YOU QLTRIED BELONGS TO AN INDIYTDUAL IDENTinED AS A 
FOR.MER MILITARY DETAINEE 

DO NOT DETAIN OR ARREST THIS INDIVIDUAL UNLESS THERE IS EVTDENCE OF A 
VTOLATION OF FEDERAL. STATE. OR LOCAL STATUTE(S) 

UNAUTHORIZED DISCLOSURE IS PROHIBITED 

INFOPJtlADON THAT THIS INDIVIDUAL MAY BE A PERSON WHO MAY POSE A 
THREAT TO NATIONAL SECURITY IS THE PROPERTY OF THE FBI AND IS A FEDERAL 
P,ECORD PROVIDED TO YOU^. AGENCY ONLY FOR INTELUGENCE AND LEAD 
PURPOSES THIS PJECORD- AND ANY INFORMATION CONTAINED WITHIN IT. MAY 
NOT BE DISCLOSED OR USED IN ANY PROCEEDING WITHOUT THE ADVANCE 
ALTHORIZATION OF THE FBI 
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WAffWm} APPROACH wmf CM/TMm 
•♦•JAW ENFOW’KWKWr SKWWFlVfc INimMAflfm**’ 

I J. 4.1. 2. (10 Sik'Bl flit .Noifiinjrliou^ 

(S//NI-0 liivMtigiitfii'i iiuy maik a subject t KST file cnliy m ssleai; whicb wiU pfewal mf 
NCIC: quriy from returning a KST iccxjid For rximple tfdunnf, a ftMMmt HraffK ^cp bf 4 he» 
eijfoit rrnent queries a subjeri's name tliat has been tdenlifteid as a isleiri btf. ^ dfirer wiJS 
receive all cnininal records for the wkftxi that are tn NCIC. fcwl mU not be ooCrfied ftat ftr 
siUrfert is a suspected teirorist In order to enter a subfert*s record as a nlnri IhI, Ae ncoKaalitig 
official must articulate a specific, narrowly defined, legfiumte operaboiial jaattficatscia 
Possible justificatiom for a silcnl hit (with Ae requtstle wntteo artKula&Do) way in cfa d c Ac 
following 

• (S//NF) The subject of ihe mvcstigatioti is Ibe t»get of Zd-faom'a-day, seven-days-a' 
week (24/7) physical surveiUaaoe undercover activities and oper^sotis. and/cMr feasrinre 
source operations 

« (S//NF) The subject is an employee of a mendieT of or affiliated wiA. a mtevy bderal. 

state, local, or other taw enforcemait agency or any group Aat may have aoccK to NdC 
terminals 

• (S//NF) Other unique operational circumstances m wtoch a oomBiaiiiig offiend can 
articulate a reasonable and dialled justificatioa sidiy the subject needs to be mr faded at a 
silent hit 

(U//FOUO) Becau-se a silent hit raises officer s^ty issues, sul^ects who ace vudcit or are 
known to be armed and dangerous may not be marked as silent hits 

(U//FOUO) Other Aan at a pnmary screening by CBP and in ?^C!C, subjects madeed as stkm 
hits are not ^silent" in any other watchlistmg-siqjpofted sj^stems Kequests for wlem farii dvmg a 
secondary screemng by CBP can be coordinated on an mvestigatioo-by'iDvest^aliicm bass &c 
USPERs through Ae TSC (refer to subsectroo U 4.6 I for furdxr mfomiatiaaj 

11.4.2. (1*) General Ti anspoitation Sedafti’ Administratioii rrS.\) WatrUisziBg 

Guidelines 

(U//TOUO) The watdilistmg community^ has developed five funeral gutdehnes legaaifaig the 
inclusion of an mdividual on Ae TSA's No Fly and Selectee Lists that are necessary to 
effectively implement Ae No Fly Li^ and Selectee List entena 

(U) The five general guidelines are ^ 


* (U) This section contains Saisitii’e Security Infoimanoa (SSi) tltai u coonofied ueda 4$ CFE Paru 15 ad 1 5M. 
No part of (his material may be disclosed to persons wiAout a 'need to Ima.^ as .irfaed bs 44 CTP.fMa 15 xsd 
1520. except with the rnitteo permission of the A^umsmtor of iIh TnnqwrtniMB Senann Afthatmavimiitn 
Secretary of TranspoitaDon. Unambonaed release iiii>' lesaJt m ovtl poralt)' w c^es aOia ¥m 
pubhe disclosure is governed by 5 U S-C. § 553 and 49 CTR Puts 15 aad 1530 
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1 (\J'"SSI) When rvadtMtmg the si^ficancc, lelevance, ;uid validitY of a lineal, caiehil 
considnahon should be given to the extent to which llie Uireat is runent. specifit:, and 
aedible 

2 (U//SSI) The Selectee List is not a default position fot those who do not (pialify foi 
inclusion on the No Fly List and lias distinct elements tlial must be met befotc an 
indiMdiial may be included 

t (U'TSSI) The purpose of the No Fly last is to protect against acts of terronsm, inclusion 
on the No Fly List has consequences that are operational, legal, economic, and 
diplomatic 

4 (LI//SSI) Except for expedited nominations in accordance with watchhstiog gmdance, the 
decision to include a person cm the No Fly Ust or Selectee List must mclude substantive 
derogateny infoTniadon (refer to subsections 114 3 and 1 1 .4.4 of tins PG) tli^ satisfies 
the catena and justifies inclusicm on either list In investigations where ncmimations 
contain no substantive derogatory information or contain msufficient substantive 
derogateny information or msufficient identifying criteria, die individual will not be 
included on either the No Fly last or Selectee List 

5 (IJ//SS1) In accordance with watclihstmg guidance, die White House may, on a temporary 
basis, direct the TSC to place categones of mdividuals who do not meet the estabUshed 
catena on die No Fly last or the Selectee List, when necessitated by exigent 
cuciuastances, in response to credible intelligence mfoimation or a particular threat 
stream 

6 (U/'SSI) Under exigent operational circumstances, when derogatory’ infoimation may not 
be widely disseminated or stored m TIDE, mdividual watcldist status determinations can 
be made by the Director of the TSC, m accordance with the relev ant catena 

1 1 4.3, (V) TSA No Fly List 

(U/FOUO) The TSA No Fly Ust is mtended to prevent potential teironsts fi^om boardmg any 
coimuercial aircraft tiavelmg withm, to, or through U S airspace, or fi:om boarding any U S flag 
earner regardless of onginatioa or destination. Inclusion does not provide grounds for anest, 
detention, seizure of property or documents, or referral to a foreign goveniment for comparable 
actioa Inclusion also does not alter the fundamental nght of U S citizens to return to die Umted 
States FBI en^lo^ees may not state ot m^Iy to watchlisted mdividuals that tlieir ability to board 
an aircraft or eut upon their cooperation with the FBI or 

to 

(U 'SSI) Indniduals, regardless of atizensUip. who pose any of the follovvmg threats, may be 
placed on tlie TSA No Fly List: 

■ (U'''SS1) A threat of committing an act of “iiiteniational terroiisni oi “domestic 

tenonsm (as defined tn 18 U.S.C. § 2331). widi respect to an aircraft (including a threat 
of air piracy or a threat to airline, passengei. or civd aviation security): or 
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• (U//SSJ) A thrcjl of ronafntttmg an act of ‘ domr^r twwisni" <»s defwjbpd m 1 8 If S C; $ 
7J31(^)), with f<*spe<t to tfac Uunntlxvd. tx 

• (U//SSI) A thieal of connuittuig an act of intei national trrrorum (at ddTinrd lo 1 ? 
use 5 ?.331(1)) against any USG fiialrty aliroad and ^soriatcd Of ^uppoituig 
pnsofinel, inching U S etrdxissies consulates and nmaioos, nuirtsiy tnstallatjioas (as 
defined by 10 U S C § 2S0l{cX4)) U S ships, U S atraaii or odicr auxikary craft 
owned or teased by the USG, or 

• (U//SSI) A threat of conducting or engaging m a vjolcof ad of tenonara and who i» 
operationally capable of doing so 

(U//SSp An individual is “opcf aUonally capable’ if based on crediMc u^Uigeoce he or sbe 
actuig individually or m concert with otbeis, reasonably appears to has'e dae ability, knowledge 
opportunity, and intent or is actively seeking the opportunity to engage m a viQigtf act of 
teiTonsni cimsistent with 18 U S C § 2331 or IB U S C § 2332b For exanipfie attempting to 
obtain an improvised explosive device (lED) would indicate an individual a operationatly 
capable of comrmtting an act of terrorism However, simply couductii^ research conceimag 
lEDs would not alone be sufficient without additiooa] activity Dependu^ on cttcii rrist aoces and 
m combination with other &cts. scoutmg potential Uurgets or tra\'cling for no legitmute purpose 
to places that have terrorist training grounds regardless of whether the person k fresestly 
capable of using an TRD . might also indicate an individual is operationaily capable of commUlii^ 
an act of terronsm 

(U//SSI) Id deteiminmg whether an mdisidual is '^operatiorially capable, coas i d ef a b oo should 
be givMi to the following possible indicators fegardmg abibty knowiedge. opportumry and or 
intent; 

• (UV/SSI) The subject h^^ undergone tMTorist traimng ot been protided some uKtrueboa 
including receixing milrtary tiammg by a desipiated terrorism group 

• (U^/SS^ The subject has indicated his or her mtent to participate m plssuog or cooduciu^ 
an attack: 

• (U//SSI) The subject has expressed a desire to martyr himself or berselT 

• (U//SSI) The subject is m repeated contact with a known terronsi Valuator who reermts or 
facihtates travel of operatives, 

• (U//SSI) The subject is planning an attack either alone or as part of a p^oup: or 

• (U//SSI) The subject is associated with a terrorist gtoup or cell and is accumulating 
weapons or explosives. 

{U//FOUO) Generally, m order to be included on the No Fh' or Sdectee List (detailed bek»w ‘ 
two preconditions must both be met 

I (U//TOUO) Miuiinum identifying biographic entena nxisistii^ of first name last name 
and fill! date of birth are required 

2. (U/TOUO) Minimum substantive derogatory entena for mclusKHi must be met 
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out)) I liHWi itt tMjrt oUliirat iiiruniuiltiifi HirrHiip. the c ftb-iia (lr«nl»F<J jiImivi* thr 
1*W cast- *u witli (’ ll>, iiuwl tk‘t«nii»p wli(^w*t tlif swhici :t(i) of liir 

m\TsUBaliaii qiw.tifi« ftn ihc No My l -is1 If the rasr jiRrtil dotrimiiM's tliiit tfw KiJ>|ri I t|uaiifu‘N, 
tlir wab WtsI irqiicsl nnisl Iv siUniiiilrtl to IKhX witliin M Iiotm. of himIi a clrtei initialuni I'SA 
Kubirt t nwttn fxivits asiu^Knl to the THC levipw all ntmmiiUnwisi to llie No Hy Iasi, aiul I'Sf' 
nuv »ieiiv a 5 ub|oct's atlditum in rcino\Td fiinii tiu* Iis) if it is «It*tmnint*ci lln* iinlivutual docs nut 
iiicH tlip above ( ntnia 

1 1 4.4, fO) I SA Sdertee Ltsl 

(TJ VSSI) The TSA Sclei lcc 1 jsl is uUciidet) to picven! a potcjitial tciiof isl liani passinf! tliiougli a 
TSA rhcckpoint without iccciviiig a sccondaiy licrrciuiip. Ilic saecimp offered by sclcrtee 
staUis IS solely to search foi weapons amd odin danpennis ilents pnoi to Imaiduip an aiiciafl It is 
not a search designed to gam adchtionaJ mfoitiialioii thiougli pocket liltei. addiess books, and tlie 
like An individual wlio does not meet the ciiteiia for inclusion on tlie No Fly Last, regardless of 
cihzeaiship may be hsted as a TSA selectee if the uidividuai is botlj:^ 

1 (UZ/SSI) A member of a foreign or domestic tenoTLSI organization (mciiidmg a "foreign 
terronst organization ’ designated pursuant to statute or executive order) 

2 (U//SSI) Assoaated with ^‘tonotist activity" (as such term is defined in subsection 

21 2(aX3)(B) of die tnmugiatioii and Natiouahty Act [8 U S C. 1) 82(aX3)(B))), unless 
uifoniiation exists dial demonstrates tliat the application of a secondary screening to such 
a person is not necessary in winch case such persons may be excluded from the Selectee 
last 

(U/TOUO) Subject matter experts assigned to the TSC determine if mdividuaLs nominated as 
selectees meet entena for tins list. TSA personnel regularly review selectees and may 
upgrade or remove a subject from the Selectee Last if current intelligence shows that die subject 
either meets or does not meet criteria I and 2, as listed above TSC and/of TREX will notily the 
case agent of any changes to the selectee status of the subject 

(U TOUO) The minimuiii biographical information needed to uonunate an mdividual to die 
Selectee List is the first name, last name, and full date of birth. 

1 1 . 4 . 5 . (V- .TOCO) Consular Lookout and Siipporf System (CLASS) 

(U'TOUO) Subjects may be included m the DOS s CLASS databa.se CLASS lias two 
subsystems CLASS'Visa and CLASS-Passport. CLASS -Visa is used by DOS to screen non- 
USPERs applying for visas to enter the Umted States (USPERs are not included in CLASS- 
Visa) CLASS-Passport is used by DOS to screen USPERs .ipplymg for U.S passports 

1 1 .4.6. (1 TOl O) TEC S System 

{U'"FOUO ) Individuals may be included m the DUS TECS system, which serv'es as die prmiary 
integrated lookout system currently available at U.S ports of entry DHS uses TECS to screen 


{!*< For uidiuoml infonuaaoiL please see TSC's 2015 Witchlisi Guidance. § 3.112 
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UhJi tJSPFiR* Mid iwiiJ l.'JIP qurry TW’S wiirn m uAivtAr^ to^slrr 

Uh* liriitrd Sutrv 

1 1 .4 6J. 17 (Stiwii lli»> 

(U/A JiS) Fof njMY «i:ioii4J nrt?<fc. diear v an exjr\%mfm rtfde m TF/-S rJiied a '17 Hit) 

{-jui tie lAmrd oii a KST leexird fitir a pstwenf^ t«bo oiatdm a^^wMf tibr TSDB Vvt td iw rode 
will titakr tlir wati hhst jnfbriiation invmMe to a CHP oSka wt fbe port of entry PrjBWtyjl 

and tltus prevent the paKsengn*! referral to nrrxind.^ ttcveoamg To deo i g i i a te a rer^ord ibr a 
silent hit, TSC: may advise tl^ case aj^enl dufinfF. die enrounier maoai^sient procew of Ar T7 
designator and its ( Jiter la and seek conetMience ftom (be caae a^^rnl to d/suffute Ac sdbfeci m a 
T /. If tlie case agent agrees, the agml will be reepured to cofi^ilrte an fD 9R3 to modlrfy the 
suliject's watchlist !rtatus After the subject has been changed io a T7 (he TSC mS advste CBP. 
vu established channrls, of the watchhst status riian^ The cnlma for desi^ntaaa of a 
passenga as a T7 are 

• (U//LES) Be the cinrciit subject of an FBI cxiurteit c gonsm uivetfigpaoo 

• (U/ZLES) Is not on either die TSA No Fly or the TSA Sekdee bsia 

• (U^/LES) Not be flagged in NCIC as "Aimed and DaiB|cTOi»." 'Violcat Tadencm." 
“Biqilosives Expertise.” ‘Suicidal ” or 7(4311131 Aits Experts 

m (U//LES) Ekies not pose a Areat to officer safety 

• (U//LES) Be a United Stales Person (USPER) 

11.4.7. (tV/FOrO) TIPOFT t nited StatevC aiuda (TL SC A.V> 

(U/^OUO) Non-USPER investigative subjects may be emered ntto TUSCAN a pro^asa bxied 
on a Uruted States/Canadian agreement through wiudi sensitn^ but tmejasatfied Imo|Jci|Ak 
lookout data elements od a subject are shared wiA the Canadtan iDvenanem Derogatory 
infonnation is also transferred to the Canadian govermneol on an nmeshgadoa-by gs^esti,g3noB 
basis Canadian citizens are not included in TUSCAN. USFERs are not mchdfd m TUSC AN 
unless they are on the No Fly or Selectee or have an active federal arrest warrml 

11.4.8. (X7/T01'0) TTPOFF Australian C ouBteiteiTomm laformatioa Coim'ol SvsieiB 
(TACTICS) 

(U//FOUO) Non-USPER investigative subjects may be entered tiHo TACTICS, a iaogijia based 
on a United States^ Austiahan agreement, throudi whidi semitrve bat unclassified biogr^ihsK: 
lookout data elements on tlv subject ae shared with dae Austialiaa govecmiEitf Dcn^aiory 
mfonnaUon is also transfened to the Australian govermoeni on an mvesUgatiQis-by-Brves&gatioo 
basis Australian citizens and permanent residents feoin Australia. wiA the exr^pcma ei drose 
who hold dual U.S. citizensh:^, are included in TACTICS. L'SFERs are not mchadtd m 
TACTICS unless they are on tbe No Flv or Seketee Liste or have m acme federal acmt 
warrant 
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1 1 .4.0 . (D AcVitiVKtiial Sii}»ptu (4 mI 

(Lf'Vl*tXX>) Tin* I'sr. tlnuu}>h the* also nukes Iritwtst ulnitirins ac t-essiblr to ntliei 

entities tJiioii|!h liie rrpJai e.\|i€Jit of ii|xlaled subsets of TSDB ilau lliese im likle. 

• {\ ’ VFOl'O) Other siippoHnl databases, llie TSC al.so piovidrs tfac HU and rnUiii 
othef federal aiithoiittes with access to TSDB iiifoniubon fm sciecnmg or analytirjil 
piuposes This may include access to the FBTs centtal lecoidkeepuig system, llie fTTTF 
dat^use. and the TSA 's Office of Transport aboii Thieal Assessment d^aba-se 

• (UM’Ot'O) C eitain fomgn goi ernnieDts. The TSC provides a subset of the TSDB to 
certain foteipi partners in enchangp for then tmonsiu screening mfomudon 

1 1.5. (10 CTI> Nomination Policy 

(U'^/FOUO) Case agents must submit watchlist nominations to TREX for all subjects of 266 or 
41S mx^estigations. m accordance witli subsection 11.6, with the exception of investigations 
prrdirated on a victuxL organization, activity, oi congi^able umdeiitified entity foi whicli 
ivatcfahsting is ineffectis'e Sidijects of other CTD-managed mvestigative classifications should 
generally be reclassified to 26<S or 415 mvestigabons if there is reason to bebeve tlie subjects 
meet the watchhsting standard (refer to subsection 113) Predicated CT subjects not opened as 
2tS6 or 415 sidijects may be caasidcred for watcliltstiiig on a case-by-case basis, but in all 
ctirumstances must meet the watchhsting standard 

(U> 'FOUO) Subject matter experts at TREX must evaluate each nonuuation to ensure the 
watchhstuig standard has been met and sufficient identifimg information is available TREX 
must notify’ and pronde guidance to FOs, by e-mail, of subjects who will not be submitted to the 
watchlist 

] 1.6. (C) Watf hlisting Submission Standards 

11.6.1. (T) Subject Nomination 

(U FOUO) Case agents must noounate individuals for inclusion m the TSDB, as required by die 
uocmnation policy for the apphcable investigative program, by submitting a waiclilist request, m 
accordance with subsection 117 of this PG A case agent is responsible for ensuring the request 
IS submitted m accordance with the timelmes established herein The request must be submitted 
within three business days of the date created m FBTs central recordkeepmg system to open the 
investigation Nominations will include ail available subject identifiers, to include photograplis 
or other available biometnc infonnation If the subject is beuig nominated to tlie TS A No Fly 
Iasi, he or she must be submitted by the nominatmg ofificial widim 24 hours of receipt of 
information that quahfies the subject for the No Fly List. TREX must process No Fly List 
upgrades witluo 24 hours of receipt 

(U ' TOUO) If there is a determination, due to an exigent cirainistance or C'TD's duectiou. that 
die nommation needs to be sidnnitted mewe quickly, FOs must contact TREX directly by 
telepbcme and submit the watchhst request, in accordance witli subsection 1 1 7 of dus PG 
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(U//I ()t JO) Noli*; ( or CTD ptajiofurs ui rrji'^wd Id m rntfgtna afraenMace 

IS an wnrjRpfii y MtiotuifJ rcqtitiuif; swift aiaon to prevent dari]^ lf!r kfr or voiotti 
to ptopei ty 

(U//I OUO) Domfsiir taroiisni mvfKtigatKiot focuicd no naiOarTfitoatm tvtMl« 
rxIicTmsts, and sovnagn citizro extremste often have tdenfified afiftve Imirs to law ai^Birjr&aeA 
officers and ifjose in positions to chedr NCIC fiir wananfs Siit^fris of thwe invrstii^aliem mm 
br watddisled but an mdividual may be entered mCo the KST ^ ai a aleat hit m arcoid«ce 
witfi subseiTliqnJJ 4 12 of this PG Operahocta] coocenK npmAof^ w^hltamg a apcrifit Ui 
subject need to be coordinaled between the f O the CTD proj^^ manaeanraf Mat and TREX 

(U//FOUO) When the FBI opens an investigation and ftie ubfcct has already besn wairl^nled by 
anotlier agency, a case agent must sufaemt a watchlist ootmnMaon fcqMCft widno 
days of the date created in the FBI * C4E:tfraI recorc&jfepmg system to open the mves^actoc fie 
request will enhance the Terrorist Identities PatMnart finvnonmezM (TIDflE) setord and 
dooimeni the FBI’s mvest^ative interest m the subject Failure to auhnsi the watefahst leigiest 
when another agency has nominated the indi vidual to the TSDB could resuh to removai of ae 
FBI subject from the watchlist withcx^ notifrcatiOD to the FBI Dus process eouves (he 
USIC all available infotmation if tbe ongmal noimnanng agency atlecopls to remcAT the 
subject from the watcbhst 

(tJ//FOUO) Note: As a best practfce if sufGcieitf mfbnnaiioa n knows to Nippon 
walchixstmg when the tm estigation is opened, the watchlist iH|iiest should be prepared 
and submitted at the tune the mvestigaboti ts opened 

(U//FOUO) TREX must process nominations withm Qye biginess days of recervmg ^ 
watchbsl request 

1 1 .6.2. (l^) Subject I^Iodification 

(U//FOUO) After the tmtial subcmssioiL die nommatuig ofhcial naisi update the 
request mformabem (e.g , updated derogatory mformabon that may resoh m a cfa a jigr of 
watchlistmg status, change in investigation, bio^apkical tcfoimabaa. or the oo nan a nn g 
official's contact mfonnabon) as socm as new infonnatiOD becomes avatldiie Addmanal 
identifiers must be forw aided to TREX using the watchhsi request’s modify Supervtsors 

are required to review tlie inv-esbgative file for new tdmbfrers during die 90-day file rrvirw fix 
ail terronsm mvestigabons When adding modifying, or deleting data from a specific recoid. 
only tbe subject’ s name. sex. race, date of birth, and new or changed mfoEniatioti is required on 
the watclilist request Other infoniuboG that has pres'KNisly been stdxndted need not be 
reentered 

(U/'FOUO) Modifications may add or delete mformation from an cu^amg record and or up^ade 
or downgrade a subject's watchhstiag statm If a modifiratiop is wamxed a waichhit recgies 
must be subnutted. in accordance with subsecucm 1 1 of this PG. by Ite oos^iating FO Such 
mformabon must be submitted to TREX m a timely manner, not to exceed fhj ba smes a da^~s 
from the day the new mformabon is senalized into the FBF s central recordkeeptng or tbe 

day tile detemnnation is made to change a subject s 5t:mis Wisent any cxigcni ciraa iis Q oc f « 
other direciion from CTD If exigent circumstances exist or CTD duects, FCh nKsst coneact 
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TRI-,X diicctiv iplfpkMie aiid submit walrhlist ui^iirats, in wTcndiUH-t* with iil» Uon I \ / 
of this Pf T 

(1!'’ T'0l ?0) nif 'X nuist snliscqurntly [woccss mothficatiotis witlun !«rven liusiiii*55 Hays of 
nec<f*i{>l of the watehlist lequest 

(V - TOIX)) Mcdihcabons to upgrade a s«b}cct to the TSA No Fly f JSt must (le sulnriilled by Uie 
iKmniiabug oflicia) within M hours of receipt of infoinialion that qualifies the subject for llie No 
FIv List TKHX nuKl process No Fly List upgrades within 24 bows of receipt After the arrest of 
a Handling Code 1 subiect. the oonunatiug official roast sutnmt a watchlist request to TREX 
withm tluee busittfss days of tile case agent leaiiimg of the sublet:) ’s aires! 

(L- T0130) If a subject who has been watchlisted moves to anotiier FO’s junsdirtion, tiie subject 
raiisl feniain watchbsted imtil the leceiv-mg office opens an invest! gatioiL unless the watdilisting 
standaid is no lougei met The closing FO raiist set a lead for the leceivmg FO, notif^ig it of the 
subject s iclocation and requesting it to open an investigation. The receiving FO must submit a 
watchlist request for each aibjecl. updating the TSDB record with tlie new file numbei . case 
agent 's name and any additional id^ifiers (such as tiie subject s address and dnver’s license 
numbei) resulting from the move Tlie teceivmg FO must submit tiie watcJihst modification 
request within three business days of the date aeated in the FBI's central recordkeepmg system 
to open the investigatioii If the receiving FO beheves an investigation is not warranted, the 
matter must be referred to CTD. m accordance with subsection 410 of this PG 

fU VFOUO) A watchhsted subject who moves outside the Umted States and continues to meet 
the watdibstmg standard must lemain m the TSDB as long as an FBI investigatiou remains open 

1 1 .6 J. (I") Subject Removal 

fU' TOUO) \\Tiec a predicated IT or DT mvesfigation is closed, a request for removal of any 
watchhsted subjects must be submitted, absent the cnteria set forth in subsections IJJIQ, or 
U n of tins PG 

(U‘ TOUO) Upon closing an investigation (i.e.. a PI or a full investigation) tliat has a watchlisted 
subject, a removal request must be submitted, m accordance with subsection ! 1 7 of this PG, 
Within three business day's of the written approval and aotificatiou to CTD of tiie investigation ’s 
closure The tittee-businessday time hue starts on the closing date shown ui the FBI s central 
recordkeeping system and stops when TREX receives a completed removal package 

fU TOUO) If an exigent circumstances exist or CTD directs. FOs must contact TREX directly 
via telephone and submit watchhst requests m accordance with subsection 1 1 7 of this PG 

(L TOUO) TREX must process removals within five business days of receiving the watclihst 
request 

d-' TOUO) If a sifojecl peiniaueutly moves abroad, with no known return date to tiie Umted 
States and a determination is made to close tiie investigatioti, the FO must subnut a watchhst 
removal request to TREX, as provided above. If. however, the FO or the C TD progtam 
mauaeement luui detennine^. remov'al of the subject is not warranted because tlie investigation is 
oof complete and the subject contuiues to be reasonably su.specred of beuig mvolved in terrorism 
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(IJ) Omntntrrronvn Pc»4if y ( 


Of Lrrroiist aiiivitics. dwti w^hlistuii; ovpf«i^ to ir^utr vniki ffr FBI H^§tt Id 

11 ) 1 of tills PCj and sulmmt a watrJ)listfiiridifir.atMiri trqueM anoot^rtf ibr 
individual as a nonvubjn l watrhJiKtrd pnrson 

I I.T. (U) Watcblist Request Submission Prw^s and CvUidanrr 

(U/^OUO) FO supcrvisofs arr rrsponstblr £m nxsurifig a watrJilcd faquest and dia 
accon^aiiying EC aia (1) subtratlad to IHEX w^uo the e«tab!ishad tune fraiifs drtaikd m 
subsection 1 M I of this PG, (2) the aommataon package contairM sufficHSt derofatof t 
uifomiation to establish the subject meets the uratcfalisbng standard, and O) die ide?3tfii'^« h^ed 
on the watdilist request and EC are accurate Supecvtsors are remind^] dbat the aBkur^ned ^ 
day fdc review printout includes a section where SSAc coofinii that all watchlKting ideati&rxs 
have been submitted to IHEX This mchides submrttsig a JPFX} (Joml HuHognphK. 
Group)-fonnaned photograph of the subject (c g. . a DMV photograph or a pboto^aph from 
anothei source). 

(U//FOUO) TKEX must review the watchhst requests to venfy and vahdatfe all dies 

process any watchhst requests to &cilitate watrhlming if necessary 

(U//FOUO) Ail watchhst requests, with then supporting £Cs. nxKt be ladmutlcd to IREX via 
the TREX FD 930 Database . A watchhst request must be accompanied by a supportisf EC wtth 
an appropriate action lead to TREX lo the event of an incomplete request TREX omst notify ^ 
FO to resubmit the missmg element's). 

• (U//FOUO) IT Program; TREX must venly xsd vahdate waichh^ requests fts ensf:jre dsey 
meet the watchhstmg standard (refer to sob-e ties 1 ! ^ J TREX will forward ^ fcquesfe 
to NCTC for inclusion m TIDE NCTC will tn turn expmt those fdaitifim that meet the 
watchlisting standard to the TSC for inchisiOD in the TSDB and appropriale supported 
systems 

• ^//FOUO) DT l^ogram: TREX must verify and validate watchlist requests and wiM Oidv 
forward subjects who meet the watchlisting standard to TSC for mclusaon m the 

and appropriate, supported systems If the watchlisting stanebrd is tut loet for a 
nomination. TREX must notify and jvovide guidance to the submittiag FO 

(U//FOUO) The supportmg EC must contain a short, (dam descnption of the mvestag^on. 
mchiduig tile terronst group with which the subject is associated and die type of lavoHemeiit 
(e g . frnancier. focthtator, trainer, or operator) IT Program watddist requests vabdated by 
TREX may be reviewed by anyone with access to TIDE. lOcKidmg OGA jxrscnnel The teqaesf 
must not mclude uiformation peitammg to FISA coUectioii. No Fomgn (NF) or Origuatof 
Control (OC) dissemmatioa controls, "proteci identity' individuals. Bsik Secreo' An 
infomiation. Suspicious Activity Report (SAR> and Cunency Tiaosactioo Report fCTR) 
mfonuatioiL or informaliou obtained ut ilizin g pand jury subpoenas Such mfomutoon oary he 
uicluded. but clearly nicked, m the accompanying EC if it is orcessay to si^ipcrt the 
justificabou for watchhstmg FISA-obtained or FlSA-denved identifiers lasm aho be pottos 
marked accorduigly so that they can be accurately delineated in TIDE 
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Rl IV/IVOI OKN 

(II) ( V tHiutr 

(IV/TOI IO) II tlic siifUKHtnip is tuH M*iiali/«*d iirto (iw* l lH 'i tnittiU 

l<viH(flLC<et»iiip sv^fcin at riir tinr llir wait hlist tct|iii*sl i« miltnuttnl ropirti nnisl Xtr atUM Iml U> 
iht* ittiiirsl llu-t pnx rthiir niKuii*«i Uwic m no <lrlav hi tl»** imUaJ ftuhinissuni intMlirj< atitm oi 
itttwval 

1 1 .7.1, (if) SubiiH t Idciitifk alion 

(tIf'.TOlK)) NonniutKMts to the TSDB iiiusi inrlndr 

1 (11) I OKI natuf 
AND 

2 (U) One Of rooi e of following 

• Firel name 

• Complrtf (lair of bulh 

• Passftofi uiinil.icf 

• Abril irgisbaxion tmnibri 

• mimhei 

OR 

3. (U) Two Of hkht of tbr following 

■ Country of anzenship. if difTnenl from place of butfa 

• Place of birth (city or country), if different from country of citizenship 

• Cura or partial date of birth (partial [eg . 1960] or range [e.g . 1960-1965]) 

• Full name of an immediate family membei (e.g., parent, spouse, siblmg. or child) 

• Occupation or current employer 

• Specific degrees received 

• Schools attended 

• Physical identifiers, such as race, height, or weight 

• Unique i^ysical identifiefs. such as scars, marks, or tattoos 

• Street address or other sufficiently ^lecific location information 

(1.1^/FOUO) The watcblist request and'or accon^ansmg EC must contain all die known 
ideutifving mfomiation on the indisiduaL even if it exceeds the minimum specified above This 
may also include photografdis. fingeiprints. or otlier biometric data Furthermore, all av ailable 
identifieis must be submitted to the TSD© eidier on the initial request or on a subsaijiient 


Social security numbei 
Other unique identifying mimbei 
Telephone number (unclassified only) 
E-mail address (unclassified only) 
license plate number 
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SI/ itf I //W If# Iff 
(ii)f J(piUitrTirltfjfi%nt <<a*Hr 


nunhiuMutfi iri lumU‘d * ti< mmtMtr f vsdiAiit^d fjy frA>'> ¥iaAi mayhf 

itntruniilr^f lu |}tf> I Sf ill wtllj rjnly ifinUtitMi * 

(U/ZKllX)) Hr HU to airy mrtiaJ normnuitiori. ftK)fkfv.Jt»tJn or dlir *frst. aad 

purpt^f viftof Muist irvirw mmI arldio'M llir UuQtmiuff i6«y('t» 

• (Uf/yOUO) rlit* mrluaKin itcaxiry md r/ pov^dbir idrnt<6Kr% 

• (IJf/FOVO) llir appropi latenrst of ite dnifi^atiM hamjhain mdt 

• (U//FOUO) 71ir tnriutiOQ of ititrmeats thaf. dir folyra f» Amurd md or 

)ia5> “Violmt Taidaxin, am apfHopnMe 

• (V/ffOVO) Itir jncluiMon of any actrve ftAaai wmMd(%} §m ^ £/ m $br r^air 

agerit/impervuor miut nisure distf dir miry rniurfl Ji Cari Hmdtx&?. f acd nmti 

provide thr warrant manber 

• (U//FOUO) Thr idcIuskhi of a ttataaaoA fh^ aO neccwaoKkaowB cactKXX and fnrdbrai 
conditions havr brm requested/idmnfied as approprale 

• (U//FOUO) llir accuracy of the mvrftigalfvr file nmfeer 

• (U//FOUO) If the suhmtssKM} rrqurafs an exduiioo from a parucHlar w^tddm 4bt 
exclusion must mcludr statcmcads m die waicbfaal itx|neil aod cocaaspoo^B^ £C 
justifying thr exclusion 

• {U//FOUO) The submission of photogF^dis fer each stdijecl ffaalbr leaaBe^^no 

a JPEG format and providrd to TR£X. 

1 1 .8. (L") Expedited NoEOinations 

(U/OFOUO) Eiqiedited nofninatioas are avadadble if rgipent ctfcaasaaees exist eacrv asio the 

TSDB In the e\'ent a subject s watchlistuig reepnres expeditB^ (r g. adject tasri m wsaamem,- 
the nomination must be sutnmtled to TREX (dumf buaocss boon) ot lo JeEfortH 
Operations Center Watch (outsde oonnal business hoorsj idach wt^ cendbet 
coordination with the NCTC and 'or widun TSC E xpedrted bob^^kbs BBSt vtM sseef tj/c 
criteria for entry m the TSDB The TSC will make a final descfBUBatUB if ^ 
for the TSDB. including the TSA No Fly I jo or Sekefee lasr. in addhuoB to (be ISA Itn^. ^ 
subject's record will be eiqronrd to all appnqxiair supported screening g y me ais ^ 

(U/TOUO) All ejqiediied nommauons must be sufamosed sa acaendaoer wnh l i " si 

this PG and be processed immediately by TREX w^ cabsequoar mbBssaon so the TSC Any 
supporting documentatuHi necessary to mert d»e oarmal waKMsiEQf jetfcaresirins that wax xat 
pTo\*ided in the ongmal expedited irqfuest must be pmvtdbd k? XKEX oq dir laexi bussrs iar> 

The TSC must removT the expedited irconl hom dir TS£6 aad wipported systeiiB ^ 


* (U FOUO) An unbtbiy to vmbdale a nogmuftiee ies arlwirii ® ^ T2)© iaci ^ p^rsr 'i*anca 

uttoroatiaa witb NCTC for posabie tnchwosi wiSb ^ TuX ^et^xse k HDS t sxwfc 
partial (x fiaeronttart' mfonaatkoo. 
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SI rKt-.l//NOI OKN 
(I )) (*<niiilntrtf (H1SII1 INiIh'V ( iUkIi' 


hou^, luileKs t))<* iifTinal siiflic ji'til y iriftniiuluni l[iiuiipii llir 

riHibiir iwiKTSs 

1 1.9. (!’) AiiTvt WfliTAoH «iid lii4ri|>ol Nolirp^ for Wntililislt'd Indii iiliiiiU 

(t WdUO) If an active (ednal anest waiiafit rxisis m tlic Nt'If WaiiU'd IVrsoiis I- tie (bi a 
fmoiism siibieti. tlic case apetil mmt siilunit a wairhijst request foi iKriiuiiatiini to naruUiiip 
Code t *nir docuDieutiug EC and request imist itu hulr tlie NC'K' waiiaiil miiiil.H't (Wanted 
Per sons Hie recoid nuinbet) tn lire mvestip^on of a nmenUy wati Jdisled uidivtdiiaJ tins 
dociuirentatiati luirst include all descrifrtive, btojnjapliical. or caiitionaiy irifcnitiatiun about tlie 
subiet't tlr^ has not already been entered in tire TSDB ITU^X will ic\iew tire submitted 
mfonnabon and forwaid it to Uie NCTC lor entiv into IIDE or diiectly to the TTiC, as 
appiopnate 

(UAT^DUO) If subsequent to entry as a Handhiip Code ! . tlie fedeial anest warrant ceases to be 
active m die NCIC Wanted Peisons File (e g die anest wanaiil lias been served or fecalled by 
die court), the FO must submit a notrficadem EC aiKl walchlisl modificattou request widun three 
liusiness days to change the subject to Handltug Code 3 TREX must subnut the luodificatioii to 
NCTC for enliy mto TIDE or dueedv to the TSC, as appr opnate 

(U//FOUO) In rare circumstances, such as a sealed federal uidiciiuent where a subject may not 
have a Wanted PeiscMi File record niiniber in NCIC. it may be necessary to keep inforniation 
coQceramg a penduig federal airest wairant out of die TSDB hr such cucumstances. the 
notification EC concenuiig the warrant must provide a reasonable and detailed justification for 
die exclusion (refer to subse cti on 11 14 of tlus PG) If encountered by law enforcement, and m 
order to ensure that the sutqecl is detamed long eiiou^ to allow the urdictmeut to be unsealed 
and an anest ivaanrant issued and serv ed such subjects need to be walchlisted as a Handling 
Code 2 (refer to subsection 114 1 1 of this PG) 

(U^ TFOEfO) If an active federal arrest warrant exists for the subject, absent sensitive 
ctrcumstaiKes. the case agent may apply for au Interpol Red Notice Interpol publishes these 
notices to member states so that if the subject is found, the subject can be arrested and extradited 
to the country bolding the w'arrant 

(U^TOUO) If an Interpol Red Notice is filed, a w atchlist modification request must be submitted 
to TREX with the Red Notice uuinber 

11. 10, (C) Subjects .\i rested or C onvicted of Tenoiism- Related Offenses 

(U/TOT'O) All known tononsts must remam watchhsted (refer to AnpeiidLX A of this PG for a 
definition of known tenonst ") If an FO closes an mvestigatioii of a hiowsi terrorist (e g., after 
the crumnal ins’estigation lias concluded), a modification must be submitted \Ta the TREX 
FD-930 Database and tlie closing EC. with the justification details attached TREX must then 
subimt a request to modify' the TSDB record, m accordance with subsection 1111 1 of this PG 

(U' TOUO) If an mditiduaJ is acquitted or charges are dismissed for a crime related to terronsm 
the subject must be removed fioni die watclilisf unless die subject contmues to meet the 
watchhsfing standard (refer to subsection 113 1 . Terronsm subjects conneted of nouterronsm 
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Ht 

(If) f frmOrfirtifitiHrn P*i)¥ yfMuk 


ofTrnsm inuKl br irftntvH bom ttir fijr wjOf HvUmf. tn 

rmi 

I I.J I fl>) 

(U^/^OUO) 1 Ypv Jly, dM* FBJ <iDly nommMm tiAfOtM of pf« 4 lv j«rd MKa^gtbam (tm 
wjli hlisUnf* llawn/rt. (joUm <m-uni0tM>fjt% mgy sur lo witifi) (fee fBr fietomnn it prrv#> 
wlio IS ftol dir fubfffi of a prrdiraferd tnvrseuiipdiofi wvranK wjuidmif^ and iae«la fte 
wah lilisting staiidafd (irfn to I t ^ of diM PCv) Tfaii foay latbjdr m tnuMd 

( jit inzistanr rs, dir siib)r<i of a closed FBI tavexhf>^$Mn 

(VffyOXJO} This process to vKitchlist m mdiviidua] may noM br tuaiiuced bated oo hgyhfcg sx 
suppositions The nonitnatmi; official ooust pi ovidr particidanzjBd drsogatory wiornalmw 
concnnmg the thirat posed by oonsufojecU who meet Ar W3tdiiMt»e ctaodad fa fane motbrst 
dir FBI may only Dominatr an mdividuaJ if both of far fbUimiiif cnima harw bres mf* 

1 (U//FOUO) The individual is not residiot; or pennaM^tfly located n far Utiiesi Stairs 

2 (U//FOLJO) The mdrvidual has been hniced to the nlbyeci of an adtve ft or DT 
uivesti^iou or the FBI otfanwise possesses sufficient derogakiry tadontottn to aaref 
the standard f<x watchlisting 

(U//FOUO) FBI per!ioaneI deployed with DoD mtities may not nommaie sdbjiects af aadtfary 
operations conducted under £>oD ainbonry These luhvidu^ xt aommaled So the T^EtS fay 
DoD 

1 1.11.1. (X") Nonsubject Nonuoatioo Process 

(U/TOUQ) Any FO or Legal with mfbnnatioD regarding a nanw Aj ect meeting the abose catena 
(e g , famier subjects who have lefi the counary or su^iected taroastt Mlri^fird by fare^ 
governments) mmt submit mfonnatioo to TRFX for watrfahsm^ nt accoidancr vifa far 
following procedures 

(U//FOUO) The FO or Legat must submit all watciihst requests to TKEX vta far TitxX 
Database A watchlist request must be aca»q»fiMd by a supportnig EC w^ m. appropoatt 
action lead for TKEX to assume responstbilitv for the waacbAsi record in the ev«n an 
mcon^lete request. TREX must ootifv' the FO or Leg^ to resubmn the ? Ef die 

mdividual ts already watchhsted by another agency TREX imst vobsHt an 
FD-930 to NCTC mdicatuig FBI interest 

(U/ TOUO) Subnussioas to TREX must be made m accordance wifa the umelmes escAli^ied m 
subsection 116 . TREX will not nemmate or take ovicr waaddist re^omdbifay if the FO pr osi^, 
insuffiaent uiformauon regardmg the sufaect TREX wiD ixAfy the FO if cizmit CMcaaBKaaces 
prevent watchlisting 

1 LI 1.2. (11 Review of Nonsubject Records 

(U/ TOUO) Nonsubjects nominated to the TSDB are ttadord by TSC asms the FD-$3;2 
Database TSC ts responsible for \eni\ing and vahdauof the wafchles iiatu& of USPER 
oonsubjects annually to ensure tbaa the mfmnaiioa is accunue and maa eaeOzgence reports^ 
continues to si^rst the USPER poses a natioiial secunry nsk refaied to teoonian that wamm 
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uafchlKtmg If I'SC drU*rnu«»es a fMMWiItjfct no loiip'i nirrts llu* walt hlisUiif), MaiHlaid. I’SC 
imisi nmwve the iionsubieil fiotn the watrhlisi and nobfv dw l O oi Ixpal oflitr Ilut oiip,inallv 
nonnnateti the iitdiMdual 

(IJ//F01'0) If a walrWisted iionsubjei't i& eneonnlei cd the I’SOIJ will follow noinul 
Dobficaban ptocedurrs On coniplrtioii of tlir eiK ouiilei; a ropy of the I’SOU log must lie e 
mailed to TRI'IX foi additional follow up legaiding tlie nousubjerl 's walrldisl status IKEX 
must irview the mcounin details to rnsuie tlie mdividual meets the watrhlistinp. standai d and 
must modify the reroid wrtli any new identifiers developed If a noiisuhfect is enrountered 
diinng travel witlun die United States TREX will set a Guaidiati lead to the appropriate FO foi 
appropnate local response If. upon closme of the Guat (han lead, the FO deleimiiies llierc is no 
nexus to tenonsm. TREX will .submit an FD 930 to lexnovc the subject from tlie watclihst 

1 1. 1 L3. (11 Nonsubjer t Nomination from IX) J C oinpoiients 

(U?/FOUO) On October 3, 2008. EKiJ designated the FBI as the central watchhst nonimator for 
all DQJ components Information regarding known or suspected tmonsts developed througli 
other investigatise anm of the DOJ (e g ., the ATF, the Drug Enforcement Adnumstiatioii 
pOEA], or the United States Marshals Service [USMS]) is passed at the FO level through 
established rrlabonsfaips with the FBI JTTF Uie NJTTF or the CTD prograni management mut 
is the lecipieat of tenonsm mfoniiation wlien provided at tlie headquarters IcvtI If the FBI does 
not open an investigation, but the mdividualts) meets the nonsubject nommation entena listed in 
subsectioa U 1 1 . the FBI recipient of this infomiation must provide details to TREX, as 
described in subsectioa II 111 TREX must ensure the mdividual(s) is properly watchlisted. m 
accordance with subsection 117 . 

(U' TOLO) If the Umted States National Central Bureau (USNCB) obtams tetronsm-felated 
mtelligence. it will provide the mteUigence to CTD. which will review' the terron.sm mtelligence 
and will generate Guarchan assessment leads for mv'estigatioa, as appropnate If a terrorism 
tnvestiganoQ is generated as a result of the Guardian lead, the subject w ill be submitted for 
viatchhsting. in accordance with subsectum 115 of this PG 

11.12. (11 Foreign Gov emment Iitfoi mation (FGl) 

(U' TOUG) Foreign govTinnients occasionally provide information regardmg non-USPER 
iiMiiv*iduals who are under mvestigation m then countnes for enmrs related to tenonsm or 
individuals who are reasonably suspected of engaging m terronsm Cfi tenonst activity. Those 
rccemng such specific derogatory mfonmticn] of only non-USPER individuals may submit diese 
individuals for watchksting. The receiving ofike must also seek and collect available identifiers 
and biometncs (e g., photographs and fii^erprmts). as appropnate If such FGl is provided 
through an established or foimal sharing relanonship b^veeu the Umted Stales and the foreign 
govenmieui then reason^le su^iciixi ts presumed Tlie reasonable suspicion standard, 
however must be met when information is not received under an esiabhsbed. for mal or HSPD-b 
^laimg process 

fU' TOUO) %Ticn FGl is provided by a foreign agency witii a terronsm screening mfonnation 
dianng or HSPD-d arrangement with the TSC Legat offices must detemime if the FGl was 
provided by the partner agency pursuant to the arrangement Each arrangement defines a unique 
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srxMhUffiinuH^ 

(if) (AntrHrftnimntn PtAtt yiAttdt 


watt liiiiitinie* vta/idaKt (hat «ijb|rru siibfrattrd by pmtBtt agency ommA mttf aoA tfr pm^a 
^jnu y nuLvl drvifiTuIr (hr mfarrrialjon as bnof tuiFjtnflied pttf suant lo Ifr MtrnfpyMm. ai tfHt ft 
Uirii iridjt aUon dial Ihr information hrld on (hr subfnts mrrU dir standard cudMed m ^ 
anan^rtnnil 

J l.J 2.1. (U) Wakblisling of CrimtuaJ Joflirr fa/ormatioa Srtvicrs (f JLS/ Drrtvrd 

InfonnalioD 

(U//FOUO) FGI provided to CJIS throu^ a mnzioratiduai of r^wficf atiOD or wnajj' 
nirnioriaiiied aj^eemcrit establishing a formal mformatwjn shsing reiatioitflii|> mth a 
paitner may be provided wiihoid particuJartzed derogatory udormitiofi dsierdy to NCTC CJB 
provides the personal identifiers and biometjirs of these mdividuaU to dir as part of di 
HSPD 6 information sliaring respofisibijbty Tlitf ts not an F^I nofomaftaoD fd dors dot fopwr 
an annual review, as CJIS requests updated mformatioo on a regular bans CilS pit iorward 
any updated identifiers it obtains to NCTC so the TIDE record may be updaied md NCTC cao 
determine wliedrer continued watchlisting of the individual » oKirssary 

(U//FOUO) If a foreign government provides recortk that mthide a znncture of lerromBi. 
criminal, or other mformatioo. CJIS must attonpc k> identify and separate recank related to 
terronsm, as only terrori^i records are mcludtd in TIDE and the TSDB If CJIS cmof 
distmguish between the crirmnal terronsm. and other c^egorm of records it may am i idmtf 
the entire batch of records. In addiuon information provided mfbrmally or on an ad hoc baas 
must not be forwarded to NCTC Such records and any biooietncs wiU remasi a part of die larger 
CJIS biometric boldmgs and will reniam ai'ailable in the future to cooneci todmdeals to 
terronsm. 

IIJ 2.2. (C) Watchlisting of Legat-Derived Information 

(U/TOUO) Ail Legal offices that have obtained FGI tcnonsl inlbnn^ioa nai** submU waadifal 
requests to TREX via the TREX FD-930 Database unless provided punuaei to an HSPD-d 
shanng arrangement with the TSC A waichhsf request naist be accampamed by a mpfioETiBf 
EC. with an appropnate action lead to TREX to assume responsdnlity for the waichitst record to 
the event of an incomplete request TREX must nobiy the Legal to resubmit the mtsosg 
element(s) Upon receipt of die FGI from a Legal TREX must resarw the mfenaatun aad 
submit 3 watchlist reqi^st to NCTC if FGI meets die watchhamg standad If an FGI-dexn rd 
subject is encountered, the normal TSC encouider process asist be followed Any new 
identifying information must be provided to TREX. which will moddy the subject s btograpfacal 
mfotmation TREX must set an information lead to the Legal regardmf die unr mioHnaiiOG. 

(U/TOUO) FGI provided to Legat offices pursuant to tenonsm screeamg mformanoo sharmf or 
HSPD-6 airangements with the TSC should be sent via EC to the dcsipiaicd POC inihui dr 
TSC International InfomiatioQ- Sharing Program (llSP) The partner s onanal m 

Excel. Word, or other format as submitted by the parmer should be attoched or forwarded by 
expedited mail Legat offices will be contacted pertcxhcalH- bv* HSP to assiii m cuuiacrgif die 
partner for iqxlates to the informatiou 
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1 1 I I.A (I ’> I €.1 SulHiMwMm Krvirw l*i m 

(ir/'VlHIO) A triKHivI \ Inof^ utliniiMluni iiml (iltotopjafilifi ((ii*w iiliril iilujvr in suWt timi 
H ) * ' ol Uiu Kt) that ait' |«nvuU^1 hy a Intrifiti f^ivnntnriil iiiiixl ta'iil tn 'I'KI X anil 
l««X'rs'iiM as Kil ITII X will funviclr this tiUDfist inhntiutuin (i» Nt'K' ahmp, willi an 11) MtO. 
if ncfvird m iwiin to ciiln ihr iiuhviihiaJ tnlo ni)I- anti llir 1*511))) IKIvX will mil [wovitk* 
atWhtional o^nvtpht iv trvicw nrihi*^ IXi) irt uicls iiiilrsii ackhtiotia] iiir<oiiiulitni is inoviilrd hy 
the frwnwi pntniunml oi an em oiJiit« otTiiix If a la*pal otnams aikUlional Kk'iilil'trfs, 
doopatm V infminatioa oi icasons lo imunr FGl htun I'lDh tlif ww inlrllipnuT iiiusi be nntl 
to TRl-X wludiwill foiwaiil tins infinnutioii to NCIX' llw* otipmal lecipinit of l'<il lOfioiiHiu 
lufuiroation nutst also pfoxadr finpciptiiits and biopiaphir infoinuluni to ('JIS. if available 

11.15. (11 V5 att hits tin p of DeeeastHt Indii idiinis 

CLT^<Ti()UO) llie T'SDB niay not iik lude ideniily mfoniiation of known oi suspeded tciioiisl-s 
who ate conhnued dead unless 

• (U^‘TX)llO) There is ttifomiation to suppotl a reasoindile suspinon tiiat an existing known 
Of suspected tenoirst is using dial identity infomiatioti 

• (U/TOUO) A recognized teiionst organization coUects known oi siLspected tenorisl 
ulentitY information for use by its nienibeis in piepanng fin ot t'onmiittmg teironst acts, 
and the travel doaini««s related to tlie deceased known or suspected ten onst liavc not 
been recovered 

(IJ/ TOUO) Note; A cbssified list of recognized Imonsl orgamzanoiis tliat are known to 
reuse tenonst identity mfonnabon is maintained on the NCTC Curreiil site, available on 
the SensibsTCoinpartinented Infomiation Operatioiia] Network (SCION) 

11.14. (11 Esclusion from a Supported S> stem 

(U-'TOUO) In rare cmrunistances. the subject of an investigatjon may be excluded fioni a 
particuLn watdiiisting supported system if a reasonable and detailed operational tustihcabon is 
pTonded An FO that wishes to exclude a subject frotii a supported system must articiiJate tlie 
justificatron as part of die watclihst request and'or siqipoiling EC 

(U'TOUO) Note; The existence of local or state public disclosure laws are not sufficient 
justificatioQ for exclusion 

(TJ /FOUO) Subject mattei experts m TREX will review justiffcabons for exclusion from 
suj^xirted systems and detemune whether the exclusion is vvairanted TREX must notify the 
sidmuning FO if an exclusion is not warranted 

11.15. (11 Redress 

(XT'TOITO) Individuals mav seek redress for travel delays and odier mconveniences they 
expenence due to screening and/or watchhst issues real or perceived An interagency 

of Uhdfintanding oPt Terronst fTotr/i/uriug Redress Pf ot edures between the TSC 
the FBI and other relev'aut agencies is m place to address how each agency will respond to siKh 
requests fot redress As such, the TSC mav request additional information directly from an FBI 
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VO m a I lo mptind to a irqumt fai fnIrrM A» FCJ ov a nwMt ptwiA- 
irqiirvfrcl I>y wiffaiii V) <iiy« of Ihr mxifN rjf tfir HMpirtf Alipv '^/:«w>(Winfr fv ava^Mr, 
inltanubcm I'SC ' rijakrs thf fmai flrtnintriidHin ai lo vi4wifm Ar wJlr)i}Ml fwoH «tidl ptxDsaK to 
thr rSDH be modibrd a he tetntwM 

1 1 Itii. (i/) lnliound/f>uHKiitBi] Travfl of Wal«ldl«lHl Per^Mt* 

(U//]'OlX>) If ihr f-'HI wanb a walriilMtod tdbjed to have mmnpiidni travel lbraii|^ vy^snmof, 
agrnc ITS at tlir U S, boida . advanrr roonfaoaliao hetweta ^ K). Ifae CTD 
fnanaprmnit umt and tfr TV* niuit ocam The TSC maiaiUsiB ref^i^ rooian ote 
p,ovniin)eiil apewirt tlut niana|!r aod/oi uae the lemitm mldidrtli and » ikit lo 
leqiiesL^ to avoid unnecrscary delay anti'ar adtktMnaJ luulwy of vidhftxia fat whoBe 4ie 
de<;urs to allow unuiipedrd travel (e g. . Vffuhcmtt pubbr benefit parali»> FBI m^aate ane 
subject to die roncurrenre of die tacmni; anenry nd may not alaray* be hoooeed 

(U//FOU()) TSC may aUo audiarize a oar imie waiver to aflow mdrvidBab on ^ Wo ¥ff lOB to 
fly into or out of the Umtrd States The FO, liT^ ambor CfD prof^ani oanaenoE^ oad omU 
coordinate sucli requests with TSC‘s Operaborui Ceom Refer lo the TSOL ^ fagaact Mie . 
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12. (I ) liiA rMigHli\r MHlimts 

Itns «rrtioiii is niM iitlt'tMlt'i) lo l»r rxluiiistivr disciiKHKm of all avatbbir 
mvriiti^alwT inrlhiwln biU lallun of dh>M‘ luiupir to rotuilntmoiimii )nvrslip,Atioit«i I m 4 Dunr 
thofough diS4~UKsioii of all avatUtilr ii)vt*KUgattvr nirttuKls trfri lo llir DKKi 

!2,I H'f'Saiiw I 

A nanir fiacc is a fuimal to aiiotliei jigovniinimt aginit v to cotidiit t a Kcaii h 

ol>xistM»g rtM oitis for mfomialion iritaidiiig a subin t of ititeirsl Rn|itrsls (in iiaiiie Ira* rs air 
tNlYH all^ haiKitrcl hv Uir ('1D progiani inatugrriif'iil uiiil f (>i wisinng to run a lunir tiarr niay 
srnd an EC wi\h a load to dir (irogiam luanagmimt unit mi Inding dir •iuhtn I s pirdicahon and 
all a\ aibUIr idmtidns 

12.1-1. (H \titliori/rtl Invrstigalirr Ailivitv 

(1.;. TOftO) Natiir traces aie authoii/ed ui bolii dir fl and Dl' Piogiams. at all Irvrls of 
tnvestigalisT actmty 

12.1.2. TOl O) C 1 A Nainr 1 races 


(EE ’FOV’O) Requests to the CIA foi gnteral uifomution aie submitted eletliouically via die C lA 
External Name Trace System (CENTS) CENTS requests arc handled bv CIA s External 

can be accessed vaa Uie SCION system at the folkiwing 
address Trace requests aie sent to CENTS if a subjert is suspected 

of invol^mn^inerTon^^Dunnere is no known group or network with wluch the subject is 
aOiliated 

(X ■ TOXTl) If tbeie is a known group aiBliation rxithei tliaii usmg the CENTS system. C'TD 
personnel wfiil submit a tiace lequest c^le (refei to Uie CTD Teniiplates P-ige ) to die appiopiiate 
element that liandles that groiq) within C lA s Countertenonsm Center (C TC) CTC lias access to 
some data that ts not available to the EEB which may provide a ftiUei ti.ice response titan wliat is 
available through CENTS CTC will onlv conduct a trace of a subject w^ho lias a known group 
afhliatiou 

1 2.1 .5. (X FOI O) NS. A Name Ti aces 


(XT TOXTO) Name trace requests to tlic NSA are also sometmies called requests for information 
(RFT) Legal constraints forbid NSA from conductuig trace requests regarding XTSPERs NSA 
also has special requirements regarding a citizen of a Five Eyes (FAT V) meiniter cciuitry Tlius. 
It 1 $ tmpcflaat to know tlie nationality of the trace target and include it wheiie^ ei possible An 
NSA request can be made by one of two methods (1) clectromcally usmg NSA s Customer 
Gaievs as' system 01 (2) \ia an EC 


(C TOUO) Gateway method: 
system ifeing die SCION system aij 


2 (U TOL-O) EC method .An EC uuy also be used to subimt the necessary infonuahoii to 
die NSA s semor representative to die FBI who wyll then forward the mformatiou to the 
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ap|iro|Mijtr rrititirft willtirr NSA Ait nurnplr of dm hf tm hr fovoirf on 
sill* 

1 2.1. (IJ) fotw virwn 

(U//I'<)IX)) An irrinvirw it dtr of m iridivKkttaJ (nr Judnig o ndsyivl) m a oa wy 

to inforiiutiaii t)ut it arriMirte prrtuimt to, and wdtm dv tiispr jd 

aiilhoii/rd awirttfnml <if pffdir a#«l invrtttf^on S«r Sertmi f 8 

(U/rt-OlJ(J) lijt rules and slamlifd* on tiir fimdurt of nterwetn refer lo plOCi %emm U 

12.2.1. (ir; Aulhort/i^ lii\es(ijpiti*e Axtrvity 

(U//l’(JUO) Interviews ar authof tzed in botb Ibe IT and DT Pro^av M J kitci* rf 
investigative artivitv 

12.2.2. (U) IJer ooniftioii 

(U//FOUO) An FC) must impleiTvmt strong deconflirtioii tof^arnmn ptMw to iinervietnag fee 
subject of a predicated investigation to cnsufe die tnlerview will aol crmpromne nven^ipnan 
ui other FOs or alerl the subject s associates Such decooGiCttoo uamt be d o cfnentod to tfar 
ui vestigative file in advance of die inteavsew A copy nma also he provided to Ibt CTD pro^nai 
managnnmt uiut The deconiliction documentatioo must adtfarss die (bflomog nanes 

• (U//FOUO) The iiame(s) and mvestigalive file mmberfs) of any FBI ad ij e c l fsj kmmi lo 
be m contact (e g , personal teJejdiotMc or email) widi the adiject of tK anerview 

• (U/TOUO) The naiiie(s) of any mdrsiduaks) of significant neevesl (e g a known er 
suspected tenonst abroad who b not the subject of an FBI loveftigaiiool Luum to be m 
contact with the subject of the inleiMew 

• (U'A(FOUO) The frequency of cooiact and the date of the Lasi ccKact for each mlividual 
ui one of the above groufB known to be m contact smdh the subject die mimsew 

• (U//FOUO) The steps taken to coordmate with other FOs Legate aodor USIC federal, 
state, local- or foreign partners whose imcstigaiivT equities mav be oapactod by a 
planned inteniew 

• (U/ TOUO) An analvsb of the potertoal for an mihvidual di coolact wiA die ssfafect of 
the mletMcw' to be alerted to possible FBI mvestifatnre mteresi 

• (U/TOUO) A synopsis of the general inteniew approach ste^efv (eg., a feSov-up m a 
secondary screening by CBP or a possible oSa to become a CHS) and am £dfe {xspesc 
or nondisclosure of FBI affibatron thai ts plarsied 

• (11/ 70110) What, if any, mformanon from sensitive somces (e g . FIStA or a m^^sdas 
CHS) has been used Id fcvimible the uuerv'iew quemoos. and what stops are beicf tafesn 
to protect the sensjii\ e source 
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12J.5, (I*) Sensitive Financial Trace*: 

(S^-'NF) S«lMtl^’e CLA. finaxKial traces air a\'ai]able as a resource for all Ict-tIs of terrorism 
m\Tst]gsit!\T actiMty. Hiese requests are made to the CIA Natioiial Claudestine Service (NCS), 
winch mamtaiiis classified, foreign financial transaction data SeasitKe financial traces dtfTei 
fi^om normal CIA names traces Obtammg access to the data available fiom a sensitive financial 
tiace requires a separate request 

(S/ W) Requests for sensitive financial traces must be made via EC to the appropriate TFOS 
unit and CTD program management umi under die TERRFIN subfile of die respecti\-e 
mvesUgation Upon receipt of the EC requesting a sensitive financial trace. TFOS will leriew the 
request and drafi the appropnate c;d>le fc» NC’S. 
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17, (U/'FOrO) Ni'f Nrtl Umal luil iailivf 

(S/iKEL 1X1 USA, FVliY) Trtioiisls iwe of Uk* liilnwl Iws pirsMilwl lli«* Mil llie USIC, law 
enforrentmt atid U S allm witli a sciiom diailmpir llir tutiniici is a i>iuK ipal kxil foi terrorist 
oi fianiTalioiis in lountnirij;' thf pliysit ai dispeisal anti tlprmtializalion broiipjit on by ibc 
AmnKan and allied lesponse to the Seplrmljci 1 1 , 2001. attacks Ihe perceived aiHniyniitv. 
seciintv and efficietK V of online coinjiuimcatKHis liave attiarh'd the attention of tenoivsls. tlirii 
facditatois and then syDipatliizeis the result lias been an explosive prowth of ten mists usinp 
tlie Intanel foi t'omniunicatious piO|iap,anda dissenuiution huidiaisiiip leciuilnienl ufieiatioiiaJ 
pUonini!. trauunp. and radii raltzalioti Efforts by the Hit and its partners to investigate, exploit, 
and disiiipt tmonst networks are being challenged by the lapid gtowtli of tenorisis’ use of llie 
Inteinet In May 2008. live NTNl was aj^ovYd by CTD Tlie NITJ! is constiiirtcd to 
strategicallv focus opeiations tatgeting tenonsts use of llic liiteiiiel lluouglt OCEs, UCEs, and 
CHSs 

Note: (U//FOUO) Not all Group I UCOs will be uiroiporated uito Uie NTNI Each 
operation will be ev-aliiated on an m\'estigalion-bv'investipaUon basis, and a 
determination made based upon several cnteria, uicluduig scope, goals, and objectives 

r . 1 . (X7 f QUO) Net 1 alon Goals 

(&/REL TO USA. FX’EY) The goals of the NTNI are 

• (S//REL TO USA FVEY) To detect, penetrate, disnipt and dismantle online terrorist 
networks 

• (S//REL TO USA, FVEY) To know, monitor, and target an adi ersary s online donum 

• (S/'REL TO USA. FVEY) To identiiy, direct, and recruit tlie most appropnate FBI online 
resources to target U S adversanes and their otiluie domains 

• (S/^KEL TO USA. FVEX”) To des elop and manage online resources to maximize 
m-^MINT penetration into onluie tenonst netw'orks 

• (S/'REL TO USA, F\F\') To establish and support standard opeiatmg procedures for 
Group 1 UCOs targetmg leirorists* use of die Internet 

• (S/^ltEL TO USA FV'EY) To establish standardized training foi appropriate NTNI 
personnel 

1 7,2. (V FOrO) Net Talon Objectives 

l'^.2.L (Tl Effective Tasking of Undercovei Personnel 

(S//REL TO USA. F\’EY) The establishment of the NTNI allows visibiUty into tlie online 
actnities of all OCEs, UCEs. and CHSs targeting IT subjects and prosides a program to cnsiue 
they arc tasked accoxdmg to Iheir skill sets and workloads Tlie use of OCEs. UCEs, and C HSs is 
waiTanted when it is [mideiil and necessary to provide support aml^or assistance to ongomg 
ms estigatioiLs 
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17.2.2. (1 ') (.riii(r#li/Mt Jlrruriflirljon 

fS//RJ;I. TO l/SA, l''Vl'.y) fhr fT/Nl niUl)Jisbr« tfir r«tf&a!rzrcf nirthodi Au(t wB be to 
(JtTOfiflirt (XT;«. mA (T1S« within the HiT dv and wtenmMmak yrnttm* 

l ot imwe liihnniMiori lefn Ui ijj of tha P(i rr^dm^ ftir Ntf Takm fMaltfK 

17.2. -^- (f>//Nf ) .loint OprtstiiMai with I SK. anti fofrt'aatkHaal Parfnrrt 

(S/ZNi*) 'l o iririi tlir FBJ mtssion of mteUjfgeorr rolkrtiwi and to rnfwod to iovf:3li^t«r 
inofpani priofities at nati^maJ aiid/of inteinatiorial lrvH« it is neresfiarv fof (hr FBI to crjodnct 
jotiil opeialions witii (lie USIC and tntnnattonal padiirrs The VTNl wiU suftporT lfarfr>oiiit 
operations and lus thr r^qnbjJjty to utilize all dir resources and tools av-aiiablr to the FBI tJS^ . 
and inter national partners 

17,2.4. (I') F Of used Strategy and lartiial .Anahlif al ^ apahilifv 

(S//REL 70 USA FVb Y) A si;^iicant conyxiwnt in nearly evoy 17 imestiisatioc it atqjonfif 
eiiougli analytical resources to analyze and disseimnate the mfonziatioo collected lo die past 
tliese resources were linuted to the amount of petsomiej ui a particular f O and then relrvaot ilufl 
sets Tlie NTNl creates single points of cootaci wnlun the FBI that are cemei% afrxpmtat (tm 
a particular target set cn comiiEinication platfc^m 

(S//REL TO USA. FVBY) These centers of expertise help to produce aoalytK producU to 
enhance the knowl«lge of terrorists use of (hr Internet des elop tools £br identifytng and 
disinantlmg oiiliiv tenoi isl networks, and share trends in terrorists use td’thr jrMemrt B is 
(uiderstood tliat targets may aoss centers of eicperUse As such. CTTU is respomible for both 
ensuring deconfliction between the centers of expertise md for coordfoatioo of efibrt 

(S//REL TO USA. FVEY) The centers of expertise prcrvide the FBI USIC. and atfrmatiaQal 
partners the ability lo draw upon the knowledge and resources of the cetsers m their 
investigations NTNl analytic products and reporting are dusezmnated to the FBI U$IC md 
uitematioiial partners, as appropriate 

n.2.?. (T) Identify and .Address Inteffigenr# Gaps 

(S//REL TO USA FV'EY) The NTNl addresses known mlelligence gaps aod idextfihrs oahrw 
teiTonst networks in a centralized maim er consistent with the AGG-Ootn v)A DIOG The 
initiative's cohesive anahtic capabihiies allow for strsghtforward reco|rafioo oi imelfigetice 
gaps and comparison of wwly estabhshed threats Simul^iaroifih' a nelwafk of aasocialied 
UCOs effectively addresses diose intelligence ssgis 

n.2.d. (U) EstahlishinenI and Shailng of Best Practices 

(S/'REL TO USA. FATY) The centralizing nature of the NTNl lends itself to ibe as^oved 
discovery and promulgation of best practices In (be past bes4 pracaces were o&en imutegf » a 
single FO or shared only duough info rmal discussKMs between FBIKQ. FOs. aod the USIC The 
NTNl captines disseminates, and shares the tools aod methods that base proven effecme and 
usehil in un estigatmg tcrronsts use of the Inlemet B^se best practices are shared aid 
formalized ui traimng guidance, and conuniuiicatnto docifluems 
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Centi Intolhgeiu r [>i'i^#iiuii«itioa 

(Jv'lthL TO OS A. l-ATiY) A kev v€mip<wieiil of TTf’NT is its alnlity U> fiuiirlion a clraiin|^KHi.HC 
fof all FBI intrlliemcp irf^ditip tcnoiists ii&e of llir Inlmirt aiitl tlir cotlcf hvr lespoiisc to tJir 
thfeats poseil Pieviomtv tepottuig liom iiidmdiial of>ei;itiotis was smt to niirnnoiis mub: williiii 
(TD ami CvD Tlie ni^ilt of Oial system was fragmental ronifiartinciitaJi/ed intelligence and an 
tnabiiiw to see and communicate a comptehensive view oi'teironsls' use of Uie bitemel 

RRT. TO l ^SA, FATn*) Under NTNl. mtelligence repoiling on the tcn onsts use of the 
Internet can he centralized under CITU, which will appropiiately cootdinale with olliw umts 
within tlie FBI as well as with USIC and mtemabonaJ partners 

i S REL TO l?SA_ F\BY) WTien an FO detemunes tliat mformation from any OCE. UCE. CHS, 
and Of Group I UCO under the NTNI affects mvestigalive matters m another FO, die appiopnate 
FBIHQ umt must be nolifred. and tlie information forwarded to die odier FO under that office’s 
mvesUgatiw file All commimicatiofis must be properly i^iloaded to die FBTs penuaneut system 
of records, unless extraordinary circumstances necessitate an exception to this requirement and 
the exception is approved by the Deputy^ Director (DD) 

l~.2.8. C enti alized Resource Identification and Tracking 

( S ’■REL TO USA. FVBY) A rectimng bei^fit of NTNl is centralizmg the management of 
infomiaiion and resources With the establishment of this mitiatis'e, CITU and CTUC are the 
central authorities oxer resources available to target analyze, and exploit potential terronst 
activity' o nline Additionally NTNl lias estabhshed tools and methods for backing the allocation 
of such resources 

l“.2,9. (C) Standardized TOO Admiiiisti athe Tasks 

I S TtEL TO USA* FV’E^') The NTNl standardizes the admmistrative tasks, as well as pohcy and 
guidelines of Group I UCOs taigetmg teiTonsIs' use of the Internet Standardized language w ill 
be created and utilized in documentation relative to CT onlme UCOs. 

!".2.I0, (V) Consistent Backstopping 

(S, REL TO USA. F\TY) Central to all onlin e UCOs is maintaining the sccunty of coveil 
operations Protecting the true identity of any OCE. UCE. and or CHS is ahvay's the pnmarv 
concern in any decision related to these operations Tliis prmaple extends ev en to the decisions 
to disseminate die identities within DOJ and among JTTF partners. Tlie NTNl standardizes die 
backstoppmg process and procedures for Group I UCOs taigetmg terrorists use of die Internet 


i"".!.!!. (1‘ TOl O) Net Talon Oiganizational Sti uctuie 

i S REL TO USA The NTNl serves as an orgaiuzabonal tool to bring similar CT Group 

I UC Os Lirgefinf leironsts use of the Interne! under the program management of CITU C ITU 
expiojii mtelhgeiice to track current trends of terrorists use of the hUemei. as well as reviews 


Pnor to deploying online resources all NTNl Group I UCOs 
lenutrementsin ccHM-dm ^on with CTTL' and CTUC See the I 

information 


?eT mmmmm backstc 


Ifor additional 
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rqx»rtmg bi un ovn Imkit between viitous tmljoe OTI J alM) cemiurts »AnraiitrMrvt 

Uskin^ to iJicIiKle tlie ttae Jimg. (■ollection »id ( mnpilitism of OKA 

(S/ZREL TO USA, FVEY) A ftaurJase ojicf atirm (FOP) m a r#iOf4J I UCO that £aflft u«W dir 
NTNI FOPs ve the center of expertnr (or then target set or cofotniraralioti plalform. and 
^)pf ove the usage of OIA authorities and coordinate nudi CITU for all fipnaticmaJ osoners 
Sutxipeiations (SO) fall widiin the sc.opr of an existing FOP, and report dneetly to the FOP for 
operational coordinatian The NTNI orgamzaticxial chart is listed below m Figure 1 



- Ofvanutianal Svwc^tre 
^ ^ ChwKta of iftBi 


Figiirf i, (IV/FOUO) NTNI Orgauizatioiial Chatt 

17.3. (U/ZFOUO) Net Talon Roles and Fnnctional ResponsitHlifies 
17.3.1. (f) Countei’tert'orism Inteinet Targeting I'nit 

(S//REL TO USA, FVEY) CITU is responsible fen the eiveraU proeram maoagemenr of tibe 
NTNI and the FOPs under the NTNI. CITU must 

• (S//REL TO USA, FVEY) Assiga and priontize investigatiocts sod leaife for FOPs, 
including: 

o (Sy/REL TO USA- FVEY) Be the lead for foe FBTs efibits wifom foe FBL foe USIC 
and with international partners to deconBict UCOs targeting terrorists use of foe 
hatemet. 

o (S//REL TO USA, F\TEY) Deconflict assi^mnient of OCEs. UCEs. and CfISs aixi 
targeting of subject 
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SI < Kl ! /NO! t»K!\ 
il O I *nuilcilrit(nisiii ISUiry tiriiulr 

(S "REI 1X3 USA WF'3'1 niiitu^r .uni iiuinlain tlic Npl l^on nal;ib»M‘ tbi llir 

dn ontlicticni ;tiict piofnani nuiuij?micii1 ot'ipsouiri’^ 

(S RFJ TO I 'SA. PVTA’) COnchKt routinr auclifit to ens^ut* all (nofile and pn^nia 
mfonnaUcHi in iIm* NpI Talon Datahaj^ w ciinent and aiTiuate 

(S REl. TO USA FATr-YT Rfvtew. assign piioritize and tiack r«iiiests lo largrt CTD 
inv'esiipatuT subjects with an Iniemet nexus 

(S KtL TO USA, FV’EY) Peiiodically conduct an overall FHI strategic review to 
detniume uheii ima investigations lai geting teitonsts use of die bilemel need lo be 
opened Validation is an ongoing process to momtoi review, assess, and evaluate an 
FOP cmj will utilize reasonable methods to validate the pmpose and mission of the 
FOPs and ensure they are pnontized withm die goals and objectives of CTD 

(S REL TO USA. F\^Y) Receive and review inleUigeiice disseminations for FOPs, 

SOs OC'Es UCEs. and CHSs to 

; (S-^^/REL TO USA FY'EYO Exploit mteUigeiice to track ciureut trends of terronsts' 

iLse of tile Internet 

Cl (S /REL TO USA. FATY) Review and analyze repoitmg to uncover links between 
\ anous investigations, and provide this analysis to the appropnate entities 

(li^fFOUO) Coordmate with CTUC to ensure all OCEs and UCEs are properly certified, 
trained, and safeguarded prior to being operational on any of the NTNI ’s undercover 
operations CITU 
OCES- 
die 

uuOTTnatimi 

(U/ FOUO) Assisi CTUC lu die development of specialized training 

fU ' FOUO) Review* and apply for OLA awdiontv' as necessary, for FOPs. Coordinate 
with FOPs to ensure the language and scope for OIA authorities that benefit the entire 
NTNI are optimized All OIA rcfiiicsts must be submitted to NSLB for approval 

(U FOUO) Manage, tram, and provide oversight of the t^ierational use of OIA 
autboniies 

( U T-OUOJ C ollect OIA authority usage fiom FOPs and provide the proper reportmg to 
NSD s C ouiitertenonsm Section (CTS) regarding die OIA withm the stated tune fi^ame 

< L: / FOUO j P^Clpc^se manage and allocate budget funds in support of the NTNI major 
tn\es&gatioo 

(U ' FOUOj Assist m die preparation and presentatjon of UCO imtiatiou and renewal 
paperw*ork in acrordance with NSB uiidercmer policy for all FOPs diat will fall luider 
dn“ program iiLuiagement responsibihtv of die NTNI 
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(I/) f '<)*ifilnlrfifJTi«in i^tAti y ( tHuir 


• (U//l"Ol JO) W<jfk with (-TTiC to dctoinuTic whrtb« m fUfAmy iX fi of fif r^po^r^d l( 

wiUuii tfir ir<i|x‘ of >Jm* NTNf In additioft f*! fIJ wiU b*»lp drtrffmnf" if and Mt 
SO will tiarisitioa into an FOP 

• (U//I*OlJO) Provide the means and mhastruftme for enkurt/i|>. comHiwf 
collection. leporlinR djssmnnaUoti. and deconfbclioo 

• (U//FOUO) Recruit develop and tram tXL'Fs UCEa and CHSs tn coordinalion 
CTUC, the FOP and in certain instances CHOU or the I jcifuaw Servitr-. Se^luwr <' JAS j 

• (U//FOUO) Coordinate with FOPs on all issues cooceminp^ CSS as appJscahk to the 
NTNl 

• (U//FOUO) Coordinate coimiBJnKations and mtcRigence disseinmatioiit betwe^ rhte 
FBL USIC, and international partnas for all fOPs under prograoi manafement cd fee 
NTNl 

• (U//FOUO) Carry out ELSUR procedures, as detennmed by flie DIOG the Opeiatsonal 
Technology Division's (OTD) Data Intercept Technology Uint fDnU). and RAID s 
ELSUR Operations Unit 

17,J,2, (l^ C ountei'tertarisni Dhision Undercover OperatioBS Unit 

(U//FOUO) CTUC ts responsible for the ov-wsight and managenient of aU UCChi tisaa faQ wtdxs) 
the scope of the NTNl and must speciEcally 

• (U//FOUO) Woric with CITU to detemnne whether an existn^ UCO or proposed FC^ 
^s withm the scope of the NTNl In addition. CTUC helps determiDe if a^ when an 
SO will transition into an FOP 

• (U//FOUO) C'oordmate with CITU and NSLB to submil any proposed FOP for Group 1 
UCO review by the National Seamtv' Undercover Review Conmuttee ■ L’CRC) and 
obtain approval by the AD. CTD. accordmg to siandarch established by the NST C Q ?G 
f0307PG) . 

• (UATOUO) Review all pohetes and procedures of the NTNl and provide giudaoce ^ 
necessary, to confonn to CTUC standarck 

• (U' TOUO) Coofduiate with CITU to ensure OCEs and UCEs ae properhf emtfied. 
trained, and safeguarded pnor to operanonal activines CTUC works with CITU to enaore 



jand uDplemeised. as needed See the 
for addmooal infonnaboii 


• (U; TOUO) Work m coQrdman«i with CTTU. FOP. and tn cenam mstnees c FKX* or ibt 

LSS. to recruit, develop, and tram OCEs, UCEs. and CHSs 

(I*) rraucbise Opci ations 

(S^ REL TO USA. FVEY) An FOP ts a Group I UCO thai has been ^^ewrd bv lije I C RC wah 
Its own operatuig liudgel. which is managed as part of die NTNl The 10? will W i ti 
expertise for its target set or comimuucaiioa platform and trs respoaKibdiues 
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M t Kl ly/NOI OWN 
(I 0 ('niiutef IriKMt'vm y f tiuilt' 


• fl Ii'-’KH fi(>) 1 lave M ihb* rtntlail aiid mie < K P aiul/tM I )C I 

n (If^l (.>1 U )) N(» tnK* tiwy srivr ihr itaim* ! (>}* jm (miIIi ;4ti (K I*. «« a Ul Ir anti 

rir caj-f ap(*iit lin liif TOP 

• OlO t’txMilinali* with t'J ID <m all iinfsIipAliVf [luilnv 

• K)”) C'oimiuwU' wtlli Cl ID. C 11 FC mkI oUiti iiit rs^vai y eiifilit** iffuiidiiir, tlic 
taipriinp stialrpy hi lx* iinjilcnicfiutl by ihr rtmtari apriiis. (X'Ivs. UC'li*. jjid ('HS% 
wlioiii llic I Ol’ diiectlv <ipef airs and nianapr^ 

• (D//f-OUO) Misiar that tliF fiirilit'alKin fc« all investipalivf subjwis taiprh-d tliiuugh Uir 
FttP IS sufRciriitlv aiUmUtcd ui tlir afiiwopiiale FOP tkx-unimls 

- aT/TOUO) Appiove the usape of OIA aiithonties for CXT-s. IX’Es. and CHSs Die F OP 
suninian/es the n&age of 0[A and lepoft to CTTU as stipulated m tlie operatinp. OEA 
Further . tlie FOP is responsible lot ensiuuig all repoiiuip requnenieuts are met 

• (l^'TODO) Momioi all tX'Fs, UCEs. and CHSs to eiisiue they ate opetaUnp in 
roniptiance with all applicable legal and pobey letpiuements and duechoti 

• (I.T//FODO) Handle requests for eqiU{Hiient ot otitet resources fiom contact agents. OCEs, 
UCEs and CHSs 

• (U/ypODO) DLssemmate mielUgietice fiom OCE. UCE. and CFFS reporting, in 
coordination witli CTTU 

• (ET'/FOUO) Recruit, develop, and tram OCEs. UCEs> and CHSs. tn coordination with 
CITLT 

• (U‘ YOUO) Eatei and update OCE, UCE. and CHS infonnatioii m die Net Talon 
Database for deconfliction and program management purposes 

• (D/.'FOEFO) Conduct routme audits to ensure all profile and persona mformation tn the 
Net Talon Database is current and accurate 

■ (D TOUO) Write and submit Group I UCO proposals'renewals to CTUC and CTTU 
Drafi proposals rei^vals will be submitted to CTUC and CITU for review pnor to 
obiauung local signatures 

• (U^yFOUO) Dissenimate reportmg to CTTU and the appropriate FOs In addition to any 
^ipiopnaie investigative files. FOPs will ensure all OCE, UCE. and CHS 

to the assigned subfile under the NTNI invesPgative file 

• (U TOUO) Ensure that required backstopping is done for all OCEs, UCEs. and CHSs 
involved ui an operation 

(U ■ FOUO) Concerns regarding OCE or UCE personnel must be addressed witii CTUC. 
CITU. and die contact agent 
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i\f)€ /jiintrrlrrf'ifi)|in IMvy 


• (U//KJliO) l'.r#w«r i- fjfudtfjjtiitin with tht amirtfmif 

iMffrVhA tftf* I^OP 

» (U/ZHJIJO) l*fovidp tiMtm* wtjo will br iitijf/«ii m f tin/kr-Unff, •piv*arf»-/^4 tf;iiM«n«: liiy 
CflTJ »td (JllX;, u rrxpmdKl 

• fU//l'''0(J0) Wfjfii m ctjtndmMKm willi (TTtl, £*nX jnd »» trftma flifMJ w 

liiS to iwnul. drvrlop. and tiaifi Of'JM, IX,*!!* »d CHSf TV abkzn rraMfsAiir 
rurdiodii to validate a C'HS'i ido^y ndottnabon aMmvMim md ar^ esK Cnrr a Of*:; 
liaN bom rrmutod, the TOP » trtfmtd to r/joiply «w(k flw ffttW* 

Policy (Sutde cm all m^lm tei^daif a CflX 

17.3.4. (t*) Suboper ation^ (J>0) 

(U//F'OUO) An SO must fall witfun IV scope of an raumae POP and M dr/elnpnl m 
coofdmaljon witli iV FOP and CTTU, with the ntenf of hecorauiP a UCRf . appnwwd f f JP 
where appropriate SOs are not tndepcndml FOPs but rather wotk under the anAorttef. and dv 
binding of an nusiing FOP Refer lo fi|rf?*«han_ ljL 7 ^ ^ ^ PG for peocesa rf mniimiig m 

SO The responsibilities of an SO are to 

• (U/ZFOUO) Fall wnhm the targrung set of the FOP 

• (U//FOUO) Have at least one contact a^mt and one OCt UCE « CIS 

o (tJ/ZFOUO) Jt IS not recomaiended that the pnmary ca« agni V an OCE or a OCX 
of the SO. 

o (U//FOUO) There tmist be at least one uahMulBal of (he SO who n not ae OCE or a 
UCE, 

• (U/ZFOUO) Repcm cfarectly to the FOP for mv’esbgacrve coorthnatwa and reoerwr CTTU 
assistance, as necessary 

• (UZfTOUO) Coordinate with tfie FOP on the targeting stralcfy to be nupfoineitfed by 
OCEs. UCEs. and CHSs operating under the SO 

• (U//FOUO) Ensure that the predicatioa for all mvewigibve stfayeefi lai^ifSed !he 

SO ts sufScicntly arbculated m the appR3pn;ne SO docinncdis 

• CU//FOUO) Request the usage of OIA ai4honties for OCEs. UCE* aod CHSi fraca die 
FOP. The SO summarizes tV us^e of OIA autfaonbes and icportto die FOP as 
stipulated in the operating OIA authority 

• (U//FOUO) Monitor all OCXs. UCEs. and CHSs to ensme foev are operanog is 
compliance with all appheibie legal and pobev reqatoemeaft and dcreciKB 

• (U/ TOUO) Submit requests nsrerved from comae! a^ms OCEa. VCBl afid CHSs to toe 
FOP for equqmaeiii or other resomces 

• (UZTOUO) Dissenanaie totelhgencc from OCE. UCE sal CHS xefxrtras; m 
coordiiiatioD with ibe FOP and CTTU Eostae all OCE UCE. aad C3fS cccamuBtoataaK 
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MP c;iiHionPcl to f'iiUve files anti assifUietl siiliJiU’ tiiKln llie N'l'Nl 



invpsiipaliw file 


• 0'X)l ?0) Initiate appretmate invTstip^ations of tai^trts of mieicst dial aie widiiii die 
scope of tbe SO 

• (U 'FOITO) Upon die dueetton of die FOP CTTU and CTI JC, ebafi and otilain local 
approval fbi a Groiip I UCO (o become an FOP as part of die NTNl 

• (fT'''FOUO) CoudiK't tcHilue audits to ensure all profile and persona infoimatioii in die 
Net Talon Database is cunetit and accurate 

• (L!>T^OUO) Work in coordination widi CTTU. CTUC. and m certaui instances CHOU or 
LSS> to recruit, de\rclop and train OCEs, UCEs. and CHSs The SO utilizes reasonable 
methods to vahdate a CHS's identity mfonuatioir luotivatioir and access Once 
recruited die SO is required to comply with the Confidmttal Hum a n Source Policy 
Gjmjs. (0-199PG1 on all matters regarding a CHS 

• (L^.'/FOUO) Address concerns regarding OC'E or UCE personnel with CTUC, CTTU, the 
FOP. and the contact agent 

1 7.3^, (1*) Contact Agents 

{U/TCUO) The contact agent's primary responsibility is to manage OCEs, UCEs. and CHSs by 
acting as au mtermediary' for all commumcahon fiom the NTNI and FOs whose tnvestigattons 
ate bemg supported by the NTNI. Specifically, the contact agent must: 

• (U'VTOUO) Ensure that OCEs. UCEs. and CHSs haa-e proper backstoppmg and traimng 
for the tasks they are asked to complete 

• (U' TOUO) Ensure fiill compliance with the required paperwork for the participation of 
OCEs, UCEs, and CHSs in NTNI 

• (U'/FOUO) ProMde guidance to OCEs. UCE s.^^^HS^D|^^^®lttiieiitation of the 

targeting strategy and legend budding See more 

infofmation. 

• (U''EOUO) Monitor all OC-Es. UCEs, and CHSs to ensure they are operating m 
cocugfihauce with all applicable legal and pohey requirements and direction 

• (U' EOUO) Review OCE. UCE. and CHS reporting documents for disseimnatioii tlirough 
the NTNI FO reportuig chain. Ensure that threat infarmation is immediately disseiumated 
m the apjH^opnate form to the proper parties 

• tU TOUO) Address concerns regarding OCE or UCE personnel with CTUC. CTTU. and 
the case agent 

• (U TOUO ) Ensure FOP coordmation with die case agent concerning die subject being 
Lu geted by the OCE. UCE. and'^or CHS 


134 

SECRET > OF ORN 


SI f HI imunms 

(I f) f oiiritrrlrrfrjTisfrt I'nlu / <#uiflr 


• (UWOIX)) Siilnriil icxfiieirti Un itrwr rqufiirrmt iirnral tvsjrs fJt ^ ilA mjl&nmty to ^ 
i(‘sV4)fisiblr FOP 

• (U//POUO) C'miiftlrtr thr ^ppftifHiato 4cmin|4ififunent^ witfirn ^ arr^jirqili^hmrTitoi 

ruodiilr of IIjt FUI 's ( CitUal i«;«f dk«?pmp fof (XJa iWidVjf fX f-i* 

• (U//FOUO) C^ornpU'to tlv iipj^opnato t:HS Report Oxrufnrftt J 

at corrq>lishinail rf|iort fof C^Sa) 

• (U//FOUO) linsurc alJ CHS h^uidlnig and opnalioD is. m cfimpimite wrtft dir 
Conftdeniial Human S<mrcM PQJcy (jitide (f>l jO j) 

• (U//FOUO) Work with OCEs, UCEs, and CHSs to identify as9f« die sonabdtty of and 
validate other individuals who may be recruited as CHSs onhoe 

• (U//FOUO) If the OCEs, UCEs, aod/or CHSs are pennaoaitiy stalKioed mA 
operations within another FO’s temtory die contact agent aai^ have documetned 
concurreiice from all of the involved FOs 

■ (U//FOUO) Keep die case agent appnsed of mfrxmatioQ impading die ogaaiafjm 
other FOs and/or gov'emment agencies that the OCE. 1>CE and/or CHS is supporlaag. 

• (U//FOUO) Coordinate all reqtiests for subject targeto^ with CTTL’ 

• (U//FOUO) Ensure all OCE. UCE. and CHS online identities supportoif Clf 
inveshgations are entered into the Net Talon Database and i^xlaied as oecessarv 

• (U//FOUO) Protect the identities of all OCEs. UCEs. and CHSs for whom they are 
responsible 

(U//FOUO) Note: CHS handlers must abide by die n- ^ 

Guide (Q499PG), which has iHionty over this documeitt 

• (U//FOUO) Lmguist OCEs must provide wniten feedback on their perfbonaace io I-SS 
in coordination with die case agent Refer to subsectiot: 1 ~ A of this PG far ad&tioaai 
uifonuatioii. 

• (U//F'OUO) Be familiar with, and. as apfHopnate. use the "Clieddist for Afcnfe H«dli^ 
Online CHSs’ proMded on the CTD Tcrnpiag^ Pagg . 

17,3.d. (XV/FOCO) Vndercovei Employees 

(U) A UCE’s responsibilities, with regard to NTNL are as follows 

• (U//FOUO) Succcssfiilly complete specialized tramnig deemed appropcuie by CITL" 
and or CTUC. in addition to the required standard UCE iraimnE 

• (U//FOUO) Follow taskmg and guidance from the contact agent who has been a&agied 
to the FOP or SO. 

• (S''''R£L TO ETSA-^ FXT Y) Assist in identifying assessmg the gutability of and 
validating potential CHSs online 
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• (U/TOUO) C'oordnutr all rpqtjcsls fbi subject Uigetiu^ witli the contarl apciit. whu wtll 
then cooidmair with CTTU 

• (SVREL TO USA, FVFY) Ensure all online idctihhes suppoitinp Cl uivestigations ale 
entered into tl» Net Taloo Database and i^xlatrd. as necessary 

(U//TOUO) While certified UCEs may work tu an online role they will also lave tlie flexilnlily 
to handle &ce to face/physical world operations agamst the subjects of the NTNI. 

1 Ji. (V/ TOl O) Online C overt Employees 

(U) An OCE’s responsibilities, wifii regard lo NTNI. are as follows 

• (U'TFOUO) OCEs are required to successfiilly complete specialized training deemed 
^ipropnate by CTTTJ and w CTUC in addition to the standard OCE tiatmiig 


• (U^'EOUO) Follow t aslnng and guidance fiom the contact agent who lias been assigned 
b>' the FOP or SO 



• (S/''REL TO USA F\TY) Assist m identifying, assessing the suitabilirv o£ and 
validating potential CHSs online 


• (S^'KEL TO USA F\’EVj Be available to testify concerning the OCE’s o nline covert 
actinbes if an investigation goes to trial If the OCE is unwillnig to testify, this may 
preclude the OCE s ability to target certain subjects. 

• (U' TOUO) Coordmate all subject targeting requests with the contact agent, who wtll 
then coordmate with CTTU 


• ( S- 'REL TO USA FVEY) En-sure all oulme identities supportmg CT estigations ate 
entered mto the Net Talon Database when they are aeated and updated. 

l'’.X8. (IV.FOUO) C onfideutial Human Sources 

(XJ- TOUO) The following policies must be followed with regard to CHS participation m the 
NTNI in addition to the general CHS fjohcies outlmed in tlie ConfidefJtial Hurniin Pdm 

Guide f{M99PGt 

• (U^TOUO) The NTNI utilizes CHSs in FOPs and SOs in order lo respond to 
ms^iigativr pnoniies and FBI mtelligence collection requirements 

• tU' TOUO) Intelligence collected fi^om CHSs may be disseminated pursuant to proper 
disseimnahoQ procedures, to members of tiie uitelligence and law enfor cement 
coniinunities. in order to si^iport the USG's lational security and law enforcement 
ob5ecti\^ 
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• (U//r*OUO) A CHS wiH f olkri infmmiAtoo on ttif NTNI tnrvrsHjjativc priontief . m wHl 
as assist to identifymp, asscsstni; t^ir smtabiiity of. and v a bd a hn g pacextftal CHS* 

• {IJ//FOUO) I fandlmp apjmts fiiusi piotecl Ihr idrntitM of aU CHS* fof wfaoai Harf Mt 
responsible 

■ (U//FOUO) A CHS may be lequu ed to sign a oondisc lonire af^eonrni id ptabecS the 
sensitive nature of his of her relationship within the fflNl and to avoid jeopardizv^ dv* 
efTechveness of tlie operation 

17.3.9. (17/POl'O) Case Agents of Subfecls Targeted ftii ough -VTXI 

(U//FOUO) The case agent of a subject targeted througb NTNI provides operational overstj^ of 
all aspects of an investigation regarding that subject specifically 

• (U//FOUO) If the case agent of an NTNI subject needs assistance fdeitfifytiig the 
appropnate FOP. he or siie may contact CJTU for information rrgardmg (be capabifalies 
of eac h FOP 

• (U//FOUO) To request assistance the case agent of the subject coordmates with the case 
agent of the FOP and submits a formal request as stipulated by die FOP 

• (U//FOUO) The case agent of an NTNI siAject provides the FOP with tnfonnaitoo abotf 
the subject and participates m the development of an operational plan 

• (U/TOUO) The case agent of an NTNI subject is re^ionsible for piroviduif the FOP with 
feedback regarding the usefulness of the reporting generated from the inve^igsatifln 

• (U/.'TOUO) "Hie case agent of an NTNI subject, in coordinattoa with the FCff*. » 
responsible for disseminating the mteUigence generated ifrofn the activities of die FOP 
that are pertinent to the investigation 

17.3.10, (f) Other Goverumeiit .kgency Pailners 

(S/TtEL TO USA, F\TEY) Recent FBI efforts to mveshgaie terrorists use of the bitnuet have 
yielded excellent relationships with USIC partners and have resulted id the devdopiiiciit of 
numerous joint operations with OGAs or mtemational partners Ujxm request, the NTNI may be 
utilized to support OGAs. bodi intematjonal and dcnnrstic The following factors im^ be 
considered when determining whether the FBI will assist another government agency unhzmg 
tlie NTNI; 

1, (U//FOUO) Situations m which the FBI or die other agency serves as the prnnarv pomi 
contact with tlie OCE. UCE. aud'or CHS in the investigaticHi 

2. (U//FOUO) Tlie degree of contact the (XTE. UCE, and or CHS mauitaiits with the FBI 
and or the OGA 

3 (Ui' TOUO) The pnontv of the target 

4 (U//FOUO) Situations in which die FBI directly t^s the OCE. UCE. and or CHS 
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'' (I I 1 IHK>1 SiliMlKWis itt U'tui'h iMlIikMlIV •« 'iiiri llii I 111 

invcstifMiHHt Jiul iM m itltirt Uvr 

(11 V( H H 0 Itw* N I NI srrWs Ut tihli/r «»thn 4pni( ir’v ir^nm wtn n (i« v liu* i*U'Sl 
Hlu mil nwiuM't 

P 4 (I > Nrl 1 Jilwti <H I I tnKiii\l IS ngi mil 

(S RM IX> USA 1 \ 1 YT llir 1)1 s 1 SS/I SnvM r*. li4i»vUlitwi f itiln (I S IC) 

xs llir initial nxKitUiLUiH wf Iminnsf sihji'hwI to (iw N^I NI aiul irbteH invniiip.atians liy 
icleiiiihitip. linp.uiKj*! to snvT as (R 1 i 

I ''.4 t (l’> K<H|ui*stiii|t I iiifsuivt Siippinl 

(S KM IX) USA 1 M'Y') W'lini .m I OP m an St) Iws a nerd f'oi a liiif^iist to ati as an (K'l* m 
all NTNl irUlrd mvestijpation Uir caw* apmt niiisl contaiX t Til. I and C' lUC lin an initial 
(Usi'iKMon and an (*valiiat]on ol Ihr irqursl Litip.uisls will NQl' Iv afi^ifiiai lird I>v ot 

SO cm ’ and (TUC mil then cniUinr ibr rn|iuf mtnils I'm tlie ofirialion ui an IvC to ilic 
■HUnopinite USIX lot xsmstaiK'c 

(A* TOIX)) ISIX" caiivavsrs I'tK lu oidei to deteimine die availabihtv of liiif^usts witli the 
reqmied Lmpnape and snluect niattri -ikill sets to s'ii|ipoit such a leqnrsi IC will then jnovide 
cm.! and CTLH with die tunie(s) of the identified 1mguisi(s) Any dianges or modifications to 
the initial request for siifipoit iiiiisl be cleared through llie I^TC' to ensure that top fBI priorities 
rmiam cowed 

l''.4.Z. (11 Ti aining and Safeguai d Assess meat 

(C 'T’OIX)) Languist OCEs are leqiured to meet all taamuig and safeguard issi'SMrnrnt 
sti}nibitions set forth in 'I' r-iii .'n t i> ) of this PG 

I" 4.x. (lA Qualits C onti ol 

(XMFOCOl^ininguist^mkm^jl^be FBI aie subject to LSS s quality control process (refer 
to and are requited to have samples of tlieii work renewed, 
tn a^Sfdan^^vitl^^anmnp^onciev Quality control will provide an additional backstop to 
ensure that coii^lete and CCTTeot mfomiatioti is bemg conveyed to the Net Talon case agents 

tX’' POLK)) Given the sensitive luture of die UCO materials CITU will coordinate with die 
Quality Conti ol and Standards Unit m LSS to ensure that approfmate work samples are 
submitted by the contact agent m coordination with the case agent for quality contro] review to 
a ptederermtned time fianie 

l''.4.4. (I A Retpiii ed Feedback on Linguist Performauce 

<X POLX» hi order to effrcii^-riy give feedback to bngiusi OCEs for progress reviews. 
perfoniiaiKe appraisal reports and annual work review's, the contact agent m coordination with 
die case agent imy be asked to provide wTitten perfomiance feedback 
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17 4 5 (I -ffl l#1 * *> I ^ • I ■ I 

(l(//|Ot/<>) f.lll|'m'4 Ml Imv*' t^w /I#'" f?j >' « 'i • ' ' ^ i-r- - m •■ m , 

(mttrtfliJ (Jf 

(I J//l f)l/0) If j> 4ijy |irmil ^ I H J jfid/j|f < ^ ^ - • .r ?- Li^ ^ -^ .rr 

mtlir(X I p»fW4f»i C rn r ^ »** ; > 

I A K ffinovrfi i ljflf'iii*4 Ihwi ttir <'X f p v ■- .m, • ft<- v 

J^<>piB^iy WtU Ijr 4fM)«'<l to da- I*, - ■ . / . y - . <» “ 

(jtlin N’l'NI 

1 7.5. ri //f Of f >> f a*«o 

(S//Kf'.I If) USA f VI’ V) Jo addrf^ti tii^' Pm ^ • 

witlufi tin* FHI f mi hat takiri tfir trad ?«kI m /i-sf tbr- 

Aiitoh^ti^iJi OflTif^ (STA<)) drvrkipwl ^ ' > '”1 . ’5'^fev^J 

All (X'F Ufih CHS mA 

nnisl lx- mlfjrd ifrto dir iiMshaur fa pupo^rs. Ar'r^flyit'r: f -- - jjfe- ''■• 
piograni rriafU|?rfnmt of onltar HUMK i f hr tra*- - ^ ^ ^ 

sIoi ihI ill fbr n strni. fMilr fhr wmlral iioailm' sad «f ^ 

available FBI widr to drinruttir if -e otIs^ ,w^f Jtrf ■ * 

and/of forrign gov’mmirnt rqmty 

(U/^OUO) Thr specific purposes fex inr i Jxxi Ljm^hme ¥. ■ «r 

• (U//FOUO) Pmvidin£ a rrs. tsar drcof^lbriicm s^ifee® 

FBIusm 

• fS'’/REL TO USA F\TY> . - > - - 

idmtitirs Urgrtmg IT lavr^gacSjocib iisf I ' ty- 

and psTudonyms 

• (y^KEL TO USA. F\TV) Cfcatni? ace® i . - 

thai will capture iMgua^ abilmev aai?!»d doc' " ' ' * "" 

that can br used in idrabfvmf the appropf^^ rr - 

1~'.5, 1 . flT Informahon Stored u Net T ais& 

(S 'REL TO USA FVETI The true ames of iXE^ vX^ ^ - ■ , - - - - - 

die database This iiKludrs any a^ipfOxaiKaKd stfr^T^ ^ ^ i - - - ‘j. 

that would reseal the true identities of these na^'^^ v 

(S HEL TO USA F\TY) Characienstics oF Sir cue oF x OC^ a UtE m :^,i ■ 

be entered into the database as the prefPr Has ssv taJa* tfer idle^Rs,.^ 

• (U POUO) Ssmbol aumber 

• rU FOL O) Tvpe (XE UCE or CH.S i 

• (U EOUX)) OngmaemgE FO 

• (U EOUO) Contact ageui (oaDr. AveiciL lad ciafeaict ^loii ei t 
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• 'O) Apr fwpp 

• (l.V'TOlK»<i«KJrt 

• (VI/'VOl W) skill srts (c g . laiipiiagp^ ailtut;il kiiowlMlpr, irpiotuil kiiowinipr 
cdiK'atKMi hi^ibies leUp^tKi) 

• (tJ-'-'FOi;o) I’tlinii' hai'kpioiind 

• (U//FOl K>) Rcbpious backpmuid 

■ (XJr'/FOUO) Expcnence (e p. past enqjloyraoit. ediuralioii, tiavel) 

• (U TOUO) Invirsttgatit'ias (&le luinibeis of nuTcnl anti pre\ious invfstipaUons tjii whuii 
the emptovee lias vvoi ked) 

(S.^ TIIU, TO USA. FVT:'\') Infoiiuation relatuip to tlie ouitne uiciitilies associated with die OCK, 
UCE Of CHS must be entered into die database as pei sonas Hus mfoiiuation is hiiked to tlie 
profile page and will uiclude die foUowmg 

• (U‘ TOUO) Persona name 

• (ir^TOUO) Legend (see 

• (SMIEL TO USA. FVTY) Facilities (type [e g , email lastaiit message (EM), blogj. 
momker. screen name legend, cieation date, deactivatiou date) 

• (L' VFOUO)Cieation date 

• (U 'FOUO) Active/iiiacnve 

■ (U^ FOUO) DeactiVTition date 

(S TtEL TO USA, F\’EY) When a\ ailable USIC' and foreign partner online infoimation is 
enteted into the database 

(U’ TOUO) CTTU will have die ^djility to add additional selectors to allow a more accurate 
representation of die skills and characteristics of die profiles and personas 

1 ",5-2. (U) Levels of Access 

(U' TOUO) The Net Talon Database allows fO investigators two le\ els of access dependent 
upon then assi|siments with a third lc\ ei of access resen ed to program management personnel 

• Le\'el 1 - (S/TIEL TO USA FVEY) Access is available to all users with access to die 
FBI Intranet and does not necessitate a vtsei name and password It allows for smtple. 
limited queries mvohing source identities, including online scieeu names, monikers, and 
e-mad addresses Positive results will be noted, but not detailed, and only a pouit of 
contact for the conflicted source will be provided 

• Level 1 - (U TOUO) Access allows case agents and selected imestigative personnel die 
same capabdities as Level I access widi the added capabilities to edit and add data 
Lasers are only able to access records dial they lia\^ created or to winch they liave been 
delegated access 
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• I -fvrl j Ai tr%s IS rrsn v/'d f<n vpr/ ififsd (JUJ 

if^pcinsitiilily of tfiMaiMiimf* thr iiitr^ity »irf '^ rsjsm y Jlw iir i 

^lows Crn / dit* alwlity to iiTtiiJfvlial/*ly srart h idnittfy nd allorjJr f-s- ti*ai in#- 

most siuUifjlr tm ji piVtKiiJjif ffiP 

rnt(‘rijif! and Lpcfatintf fiif(Hiii#tn»ii 

(S//RIJ^TO USA, FVEY) All CXrtii, UCKs and f HSs viipfxirtmf H itrvf^gatKXK Mr le^wed 
to luve pf oliles wit}] dmi pei soria) clufartnistK-s cfratrd m liM* databav ft is requvisd liial 
rvery online identity assorialed wilii an <X!h a UfTf- or a <’,HS supportn^ fl mvesttgaCKiss be 
entered into the dataliase when the profile and/or the idmlrty k rreaiad 

(S//REL TO USA I'VEY) It is the irspoosibihty of Cm; and the FOP to roodoct rootoae audHs 
to ensure all profile and persona mformadon is cnrreol and ar.rnr^ Ilae ultiiuiSr rei|>QaiHfc«hty 
for ensuiui^ tltat all profile and persona information is entered aod updated is die daia ba af m a 
timely fashion is the re^ionsibility of the case a^eol 

17.5.4. (I ^ Requesting an Account 

(S//REL 70 USA, FVE Y) Only users who axe rerfuned to 
will need an account To request an account send an e- mail to 
die following information 

• (U//FOUO) Name (first ouddle initial last j 

• (U//TOUO) Tnlogy logm 

• (U//FOUO) Employee type /agent analyst contxactoi. hngiust. ocher) 

• (U//FOUO) Supcn;i.sof s name 

• (U'/TOUO) FO 

• (U/.'TOUO) Phone number 

• (XJ/'TOUO) Justification for needmg an accoum 

17.6. <tV/F0l'0) Other »l Talon PoUcies 

17,6.1. (T1 Targeting Piloiities 

(U//FOUO) Tlie subjects of the NTNI wiU be pnwilized according to the CTD bbssioi i 



e < refer to 



I "^.6,2. (V) Subjects Targets of the NTNT 

(S' 'REL TO USA. FV'EY) The target of an NTNI operation must be the predicaied subiect of au 
ongoing IT PI or fiiU investigation 

(S '^REL TO USA. F\'E\') In ordei for aa OCE. a UCE or a CHS to visit &cilmes such as a 
Web site message forum, blog, or other Internet fiicalirv'. that acnvin imisi be relevant to a 
pi edicated uivestigatioa for the purpose of obtaining stAstaamveiaieliigetJce e^ ideocc on a 
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of OT in\Tstip.;ilHTii (m (xm Ititildiiip Ikum Ilminp ai\ JiiDkiitml vimI jit (K T ;i 
1<C T.. oi A (US iTuv uitTitifv othei Miltiwls tliiitiipji iMssivt' (n active c<iiniti)inK atiini 

o« tlirsr Web silps 

tVIlbl . TO USA IAT''V') roiniitiuiit atixms witli a tUHipiedvc^feil Ciuiiiol lx* drsif^ieti 

to t'oHecI mlrlbpence cni dial mni|nedit aletl perstm H lltioiipji litiildiiip bixw litlcs, (ii collr< luig 
irUelligmce on a^Hedicaled subject an (K'lv a UC'E. or a CHS idi^itifirfi an irnlividnal who 
tnakn stalemnit!: dial {xedixate that a,s an IT sutijecl. tlien a PI ot a full inveslipatinri niust 

be opened on that inctividiial to cotitinue undercnx^ei contatiii designed to colled intelbgem'e at 
e\ i deuce on that uMiividnal 

iS 'REl TO USA. FVTY) OCT, UCE. and CHS repotliiig must state the reason fm llie 
conumuucaiion (e.g foi building bona lides or to coiuimuiicate with a predicated subject or an 
associate of a predicated sidiject of an investigation) and how tlie conmiuiucatton is relevant to 
the inx rstigation For example, if the reason Cot tlie coniniiuiicadon is to build Ixma fides, tlie 
lepofling wiU include language suiulai to the followmg ‘"Online activity conducted for the 
purpose of builduig the [(XT’s. UCE's, or CHS ’s] bona tides ” In tins example, tlus statement 
must include how the commuiucation built bona hdes and may not be a mere conclusory 
statement 

(S 'KEL TO USA. F\T Y) If the reason for the conimiimcation is in turthei support of the 
captioned uivestigatioa tlie reportmg will include language stmilar to the following: “Onlme 
acuxiri' conducted witli die purpose to furtlier support the captioned mvestigatioa(s).” 

(S' KEL TO USA. FVTY) If any mdivtdual(s) targeted otJine is confirmed to be located outside 
the Umted States, notificaUon will be provided to die appropriate Legat and the CTA. This 
nobfication will be coordinated through CITU 

(S REL TO USA- FVTY) Under certain circumstances, (X^Es. UCEs, and CHSs may be m 
contact witli individuals who are not the subjects of predicated mvestigatioos (such as for 
builduig bona fides) In accordance with the PICK} (see the subsection on authorized 
invesugative methods m assessments and predicated mvestigatious: mtervievvmg and requesting 
information from members of die public and pnvute entities) in order for an OCE or a UCE to 
engage an mdivtdual for die purpose of acqmnug substantive mtelligenceyrnfoiiiLation about that 
individual and diat individual's activities, die FO must first open either a PI or a frill 
invesugation on that individual This requnement does not appty to CHSs In accordance with 
the DIck j section on the use and recruitnient of human sources. CHSs may imtiate online 
contacts with subjects of ^sessments for the piupose of acquirmg latelligeuce about those 
subjects and their activities The speafic authorities of OCEs, UCEs, and CHSs are outlined as 
follows 

(1~J OCE and I C E Aiitfaoiities 

• < U FOUO) ^lien the purpose of an OC E or UC E initiatuig comniiuucatiou widi an 

uidiv idual IS to acquire substantiv e mtelligence about tliat individual and that mdivtdual s 
activities, the OCE or UCE is engaging ui undercover activity.' and the FO must first 
open a predicated uivestigation before the OCE or UCE may engage ui such contacts 
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(IJffVOlK)} i)ntr a furilv atrd rt tuptwd m a ndbjefl Mt fX^h Of a lX.'l': 

ifuy niyXfT lUiitnifirri ^itnnatfiifabfm with aMoriatru of tbit prr)iiir4ki4 for dr 

initpcMM' of p>untn^ addiUoiiaJ ifdrUip^r or rvuitwr on tfar jiMniiralf^ whjtirl 

(V//POUO) However, if ihe CXrB or CXIB injk»rc|urndy deveki|» nrfSrapot deroi^Aory 
ififonTiatJOfi reparrlnig tbr aK^ocialr, and tfar ptuptne of tfar romrrminu'jtfKm rfaan^ lo 
pathcrinp uitrllipmcr or evuimcr ou tfar aaMxiuir durt a^vtxialr mu«t be ptrtitrMnd m 
tfae subject of au appiofffiatr investigatiorj prior to dir CX'f. or JJCE rnatoKimf; 
conimumcalioDs 

(U//FOUO) For tfar purpose of rstafabshinp boru fades and aedtbiifr/ OCE4 and tJCF-* 
may make postings and communicalr witfa individuais who mc nrttbiv die subjerts oor 
the associates of subjects of assesanents or predicated tovesbgatioos There m 00 
limitation witfa respect to the amount of comniumcatwo au CX.’E or a UCE OEfy oufiaip m 
this regard 

(S//R£L TO USA, FVEY) [f postings are made to establisfa bona fades on a 
fonim. and the posting receives responses from other form users tfarou^ erifaer anntfaer 
posting or a direct onfane contact, tfae OCE or UCE may conmancaie wnfa Ehai user id 
continue buildmg bona fades Once predteatron is esiabbshed with die user r ou t act iag die 
OCE or UCE, a PI or a full im^eshgataon must be opened before ^ OCX or UCE may 
continue cmznnunicatmg with that individual 

(S//REL TO USA, FVEY) In order for an OCE or a UCE to target a Web Mte user whose 
commumcations indicate the user is involved in mtemational terrenun, ao appropriate 
predicated investigation must be initiated See the table below regardmf aurtfaonzed 
undercover contact for UCEs and OCEs. 
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_Na1uie»rfMJi . 

1'aiget IS tiol a 
sutijecl of a PI oi a 
full investigation 
(e g , witiirs-s, llmd 
party) 

1'aigrt IS tlie 
subjeii of an 
assessment 

raijtei IS the 
sulijeii of a PI 
or a full 
investigation 

^ 1 
D u i 

1 m 

1 c 

1 

c 

t 

^ 9 

% 
7 

Contact to olitaiu 
mtelligence about tlie 
tHgrt 

No 

No 

Yes 

Contact to maintain 
covnrr and ciedibihtv' 
only, not to obtain 
lotdligaioc. 

^>5 

\>s 

Yes 

Contact to oblaiu 
intelligence relevant to 
the subject of a PI or a 
fill! iDvestiga&on 

Yes 

Yes 

\>s 


T»ble 41. (S/HEL TO USA, FTT'\') When OuUof Uodmover Contiirl is .^Qihorizrd for an OCE or * UCE 
m CHS Au thorities 


• (U//FOUO) The term undercovef activities’ does not apply to the adanties of CHSs. 

The subsection of the DIQG on authorized investigative methods in assessments and 
piedicated investigations to use and recnut human sources permits the tasking of CHSs in 
the course of authon^d assessments Therefore because CHSs are not under tlie same 
restnction as FBI employees with respect to the requirement that a predicated 
mvestigalion be initiated prior to targeting an mdrviduaL a CHS. unhke an OCE or a 
UCE. may be tasked m an assessment to acquire substantive mtelhgence about an 
indiMdual and the uidivtdual s activities. However, before an FO may target an 
individual and task a CHS to acquire mtelhgence coocemuig that indisidual. an 
assessment must be imtiated for an authorized purpose per the DIQG (see the section on 
authorized purposes) 

• (U^/FOUO) Once an assessment is opened on an individual, a CHS may engage in 
imlimited cooimumcations with associates of that subject for the purpose of acquiring 
additional intelligence or evidence on the subject, luiless prohibited or restncted by law, 
rnorlatioiL or policy 

• (U^^TOUO) However if the CHS subsequently develops information regarding the 
assoaate that permits at least an assessment to be opened on the associate, and the 
purpose of the communications is to gather mtelhgence or evidence on the associate, the 
associate must become (at least) the sitoject of an assessment, pnor to tlie CHS 
coutuiuing commutucatioiis 
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• (tJ//|’OI J(J) f'Vii ifir (wiiiM>sr bfurw -*n<l ^/Mibility f If ' 

itfitl rorrtiiujnn atf with wVk> m*' artllift tb^ 

;isi^x i:ilf*!i ol -tufijw ts of x'ssrssimii* or ptedir jit«l Vi^f‘ w? x 

wjtfi Jt*s|x*f1 to thr iuiKiurtt of rofftrnumr ^tf/n a (. I ffv rrixy ifltiti.<tr m ffe'i 

m (S//REL I (J l/SA FVHY) If a posttnf »s rriadr tm a n»%‘-aFr b<fiard tti rst^j4t%fc 

fid*^ and tlir po\ttii|^ f«t«ves lesponw^ frrwn cj(hf7 feximi u'^rrs tliroo|idi «iuch« 
cn a dnerl oulinr fjontaci tfir C HS inay r-onimufiU Jlr v^ifh dtai ^j&rr »o rofgm^^ 
buildinp. ixnu fidrs If an authorized purpow foi an aft'a". jnmt an cy^iUii^d 

must be uutzatcd before the Cf IS cxpotmum to have camift that indr ^idual 


• (S//REI. TO USA FVEY) In oidei for a CRS to target a Web ale ttvcr 

conimuiui alioos mdicate the user is mvolvird in mternatioQal lerrormii an a^xxized 
assessment (al least) niiisl be initiated prior to die CHS mttiaitng cocaiMaf.atsc^ys with 
dial user 



.Vatuie of Target 

Target is not the 
subject of an 
assessment a PI or a 
full mcestigation fe g 

witness third party) 

1 

Target is die 
subject of zi 1 
assesszneiM | 

Target M the 
subject of a ?1 

Of a fiitl 

1 

mvestigateoB. j 

"5 

c 

w 

c 

u 

y 

Contact to obtain 
mteUigence about the 
target. 

No 

— ' 1 

1 

V>s ' 

1 


Contact to maintain 
cover and credabihly 
only. ^ to obtain 
mteUigence. 

^'es 

( 

Ves 

1 

L_ i 

Contact to obtam 
mteUigence relevant to 
the subject of an 
assessment, a PI or a 
fill] investigatioa 

\>s 

\>5 

\ ^ 

1 

! 1 

i 

Yes 


Table 5. (S/I^L TO I'SA, \V\fn QiiliD« rnifrcoTH- CeaiseT is Asiksrued fet a C HS 

(1" TOCO) Online Commuaication 


(S//REL TO USA. FVTY) An OCE mav engage m oral commuatoanoos loclnding tckp^tjoe or 
Voice over Internet Protocol (A'oIP) the ^irTToxTil of the SSA orerseeiag the FOP to ifiaicb 
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n.6.4, (IT) Acluili 

(IJ rCll’O) !ti r<»on.itn-*titHi witti NSD s CIS »iui tlir NSI .IV (O IU iiuiiiUins .i}mu.Al bVmket 
OlA jiut})OT\z^tiofis for .ilJ FOIN midef thr NTNT New FOf*s .vt* not coveted by tins OIA nnlil 
offii iaJly iiotifioti by CTTU CTIU is irsponsiblc foi aiitiu.il lenewak of iJiese blanket OIA 
aiithonzatious Ail OIA must cease at ibe end of the autJjorejed jietiod unless thae ls wiillen 
confimiaticm that die iJlA has been extended llie following guidelines will be followed by tlie 
NTNl m legaid to OIA 

(S^llFL TO USA F\'E\') As Tcqiined by Section V C of die ACKl [>mi. Section V of Tha 
's G wdtil m^s R e^at'rimp the Use of FBI Cofifuimitinl Human Sources, Ibe 
ITKKi. die Ci'mhd imPu il Hnniiin Source Pohc\ ' Guide ( 0- 199 tX rV and dits PG. FBIHQ wtH request 
appiopnaie >\D and 1X)J authofization foi pailictpatiou lu OIA that cannot be auUioii/ed by die 
SAC for all FOs uivohed in the NTNI (refer to subs ection 13 7.1 UCOs that txansition &om 
stitedv onhue to face to face may tequue OIA audionty separate from the blanket NTNI OIA to 
protect die sensitive nwthod of targeting extreimsts onluie 

d') .Vppbcation Piwess 

(L^' TOUO) OIA audionty' apphcations must be coordinated widi CITU and NSLB. who will 
work with NSD s CTS to obtain OIA audiofity 

• (U* 701)0) As each FOP is approved, the case agent must concurrently apply ftw the 
OIA authonties under the NTNI The FOP will only need to separately apply for diose 
authorities that are not mcluded in the blanket OIA 

• ( U'.TOl-.Ol OLA authonty apphcations that will benefit the entire NTNI must be 
cocnduiated with CmJ and NSLB 

• fU' TOUO) Requests for emergency OLA approval must be handled m accordance with 
the DIOG for FBI emplov’ees and in accordance widi the AttoiTiex General's Gmdelmes 
Regarding the Vse of FBI Conhdentia] Human Sources (AGG-CHS) for CHSs 

• (LVTOUO) At the end of the penod for w^bich the OIA was approved, die case agent 
must cease achnty until wntten coofimiation is provided by CTTU that OIA lias been 
renewed Without wntten confirinaiiou that OLA has been authorized for an additional 
period, cm the day dial OIA audionzalion ends, the ca-se agent must send vsTitten 
confirmation to CTTL' that all actiMties for winch OIA is lequu ed liave ceased. 

<V) Repot ting Requii ements 

(U' TOUO ) Below ai e the teiioitmg requifements for die use of OIA in the NTNI 

• ( U /TOUO) Before an FOP utilizes an OLA authonty. the case agent must iiotifv' CTTU 
No frirther action w lU be taken until C TTL' provides concuneuce This allow's CTTU to 
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niswr tfiat ^ll ntx:eaaiy vidtofiiars mc id plmji’ prior to tn OtA U m OlA 

nifttjf> anthoft/rr rrvilliptr arijvrtmi, tfar lOP iruisf comult wi^ Ci n/ ftdfit to Ilk fartt 
inrt 4 urt; of rarh artivity lluik tuAifu.ntwa Mtd <AjnfmjiatMm mgy door vta r mail 

• (U//FOUO) Contact nusl doiiatirtit all t»^ of f.HA to ^ Ff )P % VftaJ «ilb6ir « 
spenfuy] in tlir procedures section of th» docnomri If tbe m mm/ft, m ac^rnry 
autliori/cd by the OIA for the fosf tmm die r:aalarX a g ntf must re&imre a»d docianapt 
the FOP't prior coordmation with CTtV 

• (U//FOUO) The case agent imist periodfcally provide CfTU rntti a ieport wmanarmof;. 
the OIA authorities utilized, including a brief deaenpUon of tbr usafe and die KC lenal 
number As IX>J requires a 90 day report on FBI OIA activities. FOP cepomRf a 
required after an initial pennd of 75 days 

• (U//FOUO) Every 90 days, CITU must write a fc|KKl suonmin^Big die KI7Q OfA 
authonties utilized 

• (U//FOUO) If an FOP it authorized to engi^ m 0£A outside of die NT?II OfA, ^ FOP 
must compiie a report summaizing the use of that authority . Id be pros-ided dwectly to 
erru every 90 days 

■ (U//FOUO) CITU forwards OIA nports to NSD s CTS for feview. m necessary 

(U) Usage of OIA Authorities In' Undercover PersMinel 

(U//FOUO) Below are the lumtanons on the use of OIA by OCE, UCE, or CHS personnel 

• {U//FOUO) OCEs, UCEs. and CHSs of tbe N7M may utilize the NTNT f OIA andiorities 
with proper documentation of then ^aius as working widnn the auspices of dv KTKI. 

• (U//FOUO) All participation m OlA must be m accordance wdfa the CHS PG and tbr 
AGG-CHS 

n.d,5. (U) Classification Guideliaes 

(U//FOUO) All documeatation generated by personnel from ^ N7NI imst adhere lo the 

NS ICG . This includes, but is not limited to^ 

• (S/^lIEL TO USA. FVEY) The [n^otection ^ the semms^ metbod of targetn^ an exuoiuil 
Web site or onlme network (refa to stibsargoo 9 8 ) . 

• (U''TOUO) EC documentaiioD of aU acthity conducted by OCEs. UCEs, and CHSs under 
the authonties of die UCO. mchidmg analysis and conanexas on the mformaboa coikesed. 

• (U/TOUO) F!>1023. CHS Reptntmg DocunteK'’ [lesaicted at^es] do ciKneig a r top fism 
mformatioii provided by a CHS. 

• (U/TOUO) Veibatmi translations of ans' Icjil 

■ (U/TOUO) £Cs p«taiiimg to subject targetmg and taiKti&g stialeeies- 
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SI c HI l/yNOl C»KN 
(I t) ( Oiifili*llrii(»liMn I'liliry Ciimlc 


(t H)) All tnvrstipatunra tli^ riMV imimu*) iihim inuHl lir t'lMnditulitj with ( niJ. 

NSl ,H, NSn H t *I'S iuul llir itivr^ligHtinf; It* i US AO 

n.6 7. AUnini’V t«rn«*i iil 1 

(lJ//l'tHTO) As iwtTswiy all H)Ps air irqinird to mtlivichiallv idMaiii ihr ilepimt of fuiKlK At? 
rxrtiiphon thioiigli CniJ and <11 J(' Acklilunul AO ntrnuHttwi >i|)ftlu alioiui iiiiuil hr 
ctxMdinalrd vvilh CTiH CfUC NSI Jl, »k1 NSI) s ('Hi Rrl« (o tlir < . /w/ hunihi^j^ 

;v;;. j (• / .; (oMKrvi) 

n.A8. (10 liaioin^ 

(U rTOlJO) All OOEs and UCf-'s fen an FOP air ir(]iiurd lo men witli tlir FO inulricovn 
firogiani ASAC' cv'trv six months All OC'Es and UCEs air irquurd to pass tlir safrp,iu]d 
assessment and the appi opnate OCE or UUE crttificabon course brfotc brcomtnp opefational 

(U7FOUO) In excepbonaJ cimmistanrrs a nonreftifird OCE 
of the NTNt tn accordance v%ith llie requiimimts outlined in 

(I' TOUO) Select NTN1 pei^onuel. UKludmp each NTNl FOP case agent, ate lequued to attend 
annual NTNl tnumng sponsored and hosted by CITU As necesiiarv FOPs will be required to 
piti\adc personnel for tjaming coinscs sponsored by CTFU and C’TUC 

(!' '"FOUO) It is recommended that each FOP schedule a tranung conference for its personnel 
approximated' six mondis after the annual NTNT tramuig At tins tune OC'Es and UCEs of the 
FOP must bnng all of then UC hardware to the conference for inventory puiposes Attendance at 
these trauung confcieoces must be documented via EC by die FOP 

(&' KEl. TO USA FVEY) Tvpicallv, CHSs will not be allowed to attend the aforetnentioned 
tramuig courses and conferences for operattonal security leasons As additional training becomes 
available contact agents may be asked to attend these training courses and conferences and brief 
CHSs CO tlie best practices for online targeting For CHSs beginning tlieu participation in NTNl 
operations (heir online activities may be corroborated by checking the infomiatioii they provide 
via OCE OT reliable CHS venficanon and'or through open source and FBI database checks 

1"'.6.9. (Tl Safeguard Assessmeuts 

(U FOUO) A current safeguard assessment is requued for all OC'Es and UCEs prior to 
becoming operational in accordance witli the NSUCO PC (X'Es. while operational are also 
required to coinplete an annual safeguard assessment UCEs. w lule operational will be requued 
to conplete a semiannual safeguard assessment 

KAJO. (U) Consensual Mouitoiiug and ELSIK CoUection 

(U FOUO) For basic rules on consensual nunutonng refer to Section 18 of tlie DIOG Below is 
additional guidance specific lo the Nel Talon Program. 

(U FOUO) UCEs or OCEs must complete the consent forms according to the instructions hsted 
below CHSs must complete the consent fonns accorduig to the mstructions hsted below unless 
contradictors' mstnicticn is giv en b> the CHSPG , m which case, the CHS PG must be followed. 
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(I iff f f itMflt 


• (lUfUllJO) Thr u<i** ii^nt of ftir <iCM o» 1 nitt?# wrf mr4 mt tfjr n> 4 Wm 
fnHtra/l tlir fmlitir aJuM^ *tt syrfibfrf nuinba 

• (( J//I'f JUO) ’Ur rmtfail ^rtn 4 lvf mnibr% Hw h * <'X, 7 i • « imAi^ 

rjuli (ir^ni Un t^enUfuAum 

• (U/ff'OVO) in thr jddrrss firW thr fO Irjrjiiufi wliarr ihr isA jiAW j , to V swgd 

• (W/RfiL TO USA I'VhV) UrrtiJ tari] limr tlui ibr H> 4?2 fcns ^Mi^ukw 

prjlaininp, to rlrrtoofttf (timamal mowlorng. tlir < oolacl agori rtr-. 

llir CofRtt lo tfjf cfTcct of I'ht tndrvvlual gfvn CMsmai fm rlrctesir 
niofutof tng of his or hn artivmrs to toriude r sBif meMapng, WH- '*.- 4 ^. 

posting, pf ivatr Bid VoO* 

(5i//RF[. TO USA I'VhY) for dl (KiE iJCB Mid CHS rottwiioB loB^ Capfes*- *arr 
drmird appf opiiate by CITIJ imst be tJfied to co&ect jU viteai dnts r ^ais. 
and Wrb poslm^f activities Additional software is used to coftecl naUBt mmaa^&g. ». r?»rv 
FOPs may contari CTR/ for guidance ccmcamog dr approprsale sofivair 

(S//REL TO USA FVtrj DKXj Sectwo 1 8 stales that i2! rreordbo^ gmiatf is coaseA issMi 
be stoied in ELSUR Therefore all one to-onr corofwwrafiora witfi a Ogei inrhAijg 
coniinunicaUng to e-mails chat rooms imtant nmsaanng priv^ 

ELSUR vta dbr| 

All nrreai ELStl^ 

DIOtj and oliier policies must be followed 
n.7. (U) Procedures and Processes 

17.7,1, fl") Working witli Other Cos erameBt .Armeies 

(U//FOUO) errU wiU coordinate all foisA operatiom wdh OGAa and sianaiunil pttiesi mai 
will give final approval for ibe use of contradors m mi oper ^rma i CTTU bhbIk 

notified whene\'eT information needs to be p^Bsed to OGAs wirmahnoal parttcci or 
contiactors 




17,7.2. fU) Investigative File Stmefnre 


(U' TOUO) As appropriate FOPs will me standardized 
NTNL which wiU be m accordance widi the standards orglmed ni tfie DKXj 
an FO -4 1 5 file m paraUel lo the NTNI mves&gans’e file unbo The FOP m 
and UCE under its auspices m its paralicl Ai^sligaKxvT file fe ^ . | 


[hasBa 



(U^ TOUO) The list of appros'ed subfiles includes but is not ImMed Id 
• lA 1 A seeboo exhibits 


• ACCOUNT- lA -case agemcxiptes of stBi'menls and ejects 

• ACCOUNTING - case agent tracking trf UCO e^adfnRS 

• ADMIN admimstrativr items 
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SK Kl 17/NCU C)KN 
(If) C'lnirilntfniitiiHni l^tlu'y ('iiiicli: 


• BR fuunrul iitulvMt tiarkitip.of U(X)r!(|miflitmr!« 

• HR 1 A ' liiuiinal aiudy^l KUtnimits aiiil of rhet-ks 

• Cll HUTsti|?atiou rjtpmtlihiirs 

• DISSEMINA T infontuUtoti dissenitnab^d oirtstdr tfif FO 

• ELA ELSUR adnunisbativT 

• El A I ELSUR enigma! logs 

• EIA I A - ELSLTR copies and logs 

• EIAIB ELSUR transenpts 

• ELA3 - emsensuai mofutormg records 

• EMTEI J*ROD - m\'estigalive mtrlligence products 

• LEGAI. * OIA aulhoiities AG exemptions, policy public seivice announcenients (PSA) 

• PEN - pen register report 

• RPT ' CHS reporting 

• STATS - statistical accorapUshments 


(IW/FOrO) Transition to Face-to-Face Activities 



I"? ."^.4. (I") Initiating New Franchise Opei atious 

(IJ/TOUO) The FO will work widi CTTU, CTUC, and NSLB to draft and submit a Group I UC O 
prt^sal for UCRC review, using standardized NTNl language In exceptional circumstances 
and while awaiting UCO approval, an FO may operate as an SO of an existing FOP. witli CTTU 
and CTUC approval 

(U'^FOUO) In certain instances, an FO may not have the resources to become an FOP In those 
mvestigatioas. an FO may recfuest to be added as an SO under the pertinent FOP (refer to 
subsecnop 17 7 5 ) 

R1 luitiating an SO 

(Ui'TOUO) FOs phammg to i nm ate an SO must coordinate with CITU. C TUC. and tlie pertmeul 
FOP Tlie requesting FO must have die approval of the management widun the office s C T and. 
as appn^ute. cyber program, to work under the auspices of the FOP This approval must be 
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hi f Ht imf* 


(If) Ofttflt/flrftfrtiwi VtAlt.f f 


(Iw itirirritr^ m m Vi ftnitmt 'fir trvrj of tfffHovji fr(|U0t>4 m^fhr deimtmrd 
irujuf'rtrmf witfiin dr rrt|trslmK K> 

(U//J'(JUO) fV Vi fcxiirxU t atuiMfrmjr fnm dr (xrfmrnf H jf tp nn & jwi SO tadn 
If dr I'OP f fmif ui% widi dr ftnutst dr f.Mp mpseste. va //- dn 
CIIK- f (Krdiiiatr widi NSIJt lu oiiuin C''n> a|iprovai Utt dr inHiamn of ffar nrw V/ Cfl'T ' tr 
C,HJC' d»riiniriit§ C'J'l) appiovaJ m VX. futmM and nolifirt dr VO and POP Jlr lO way oW 
bcp^ii (jpaatidfis iinUl oflTtf lal notofraUfin from CTTU Of CfUf m fer^fvwd 

1 7.7.6. (f J) InlHlig«*JK f l>i^<n»iiiatjoB 

(U//101 JO) III firdn to dtSMYinnatr uitr dimmer to a fnf«^ g/r^s a mjii pmwm 
agent will ^afr an EC det ived from CXT^ UCE, oi Clifr reponmf and coordeale wxi§ ^ um 
agent of the lebted mvestigalion 'Hr FOP wiB review dr EC. wid coonlMiafe CTl^O OTFU 
will obtain designated intelligeDre dtsrlovure official CDIDO) approval and cootdmafe with T^. 
IjTgai and the CIA as spenfied by applicable MOUs. to tfrMCininalr dr 

(UZ/FOUfJ) The preceding f ecpiuenmt does nol prevent the ^meoanatiaB of raw mid^^Baee 
infonnaliorj or finished intelligmce products witfa appropnA rectpmts b accor^bEKe dr 
DIOG and established Directorate of Inteiligmce (Df) policies AB infofTnatts® ou^ be 

appropiialely documented on an FD tfi accordance with dr CHOG 

J 7.7.7. (U) Investigative Work Rofi 

(U/iT'OUO) I'argetmg re^[uests or leads from nmibeis of dr NTNT aie sent to dr CUU far 
review CTTU assigas the lead to the ^^ipropfi^ FCM* cr SO The FOP or SO mnit en«nr dK a 
proper PI or full investigation is open and the FOP sends the requestsig FO an EC docHBOdfatg 
Its acceptance or rejection of the taigetmg request 

(U//FOUO) For a lead that has been rejected the aforenmUooed EC docmirali dr irau^) fv 
rejection For a lead that has been accepted the FOP assigmi tbs lead Id the cooud ii^itfarae 
ai^opnate OCE, UCE. or CHS 

* (U^/FOUO) The contact agent coordinates targeijr^ and mrlli^iKe ^aowaatium mA 
die requesting FO. documents acceptance of tlr lead, and pro<vKles ^ opcraimJ 
targeting plan to an EC format 

• (U^'TOUO) The contact agent provides dr requcstiof FO with szaBw lydairt of far 
operational targeting on a penodic basts Tbs is documatfed tn EC fcamat to far 
operatjonal investigatn'e file and appropriate OCE. UCE. or CHS subfile 

(U/EOUO) Intelhgmcc. wbch includes, but is nor Imnied to Karbrs mt eB ig ea cp mAxmetbm 
reports (OR)- and cables, is forwarded to CITU for rciMiagit rJltoB it 

including leads, are posted to the NTNI mvTstiga&ve file. .AM O^, Ifai 
CHS communications are posted to the FOP &SO s assigned subfile undef dr XTM owflifaliiB 


fde 
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81 C Kl 1 //NOI OKN 
(1 0 C'omitnietKnisfii tVjIii v tluufc* 


17 J.8, (ITj P(<i Toimsiit-r Mpasnm 

17 * 7 , 8 . 1 . (If) StitwtiMl .\cr»inpIi'slMiHi*iits 

(U/T(7UO) ITie contaii apswit n inimrrtl lo icvifw all CK'E, IJCK, oi CHS clcx imimtaiwiii »nfl 
defcrnMiie if aiul when investipativT accomplisliiiients c an be clainiwl llir coiitacJ agmt will 
Aatm statL^ic^ foT ihc OCR. UCE, tUS aiwl fm luniself of lieraelf llie acroiiiplistin**rils aie 
pa!;leil to the VOP’s STATS subfile, tlie substantive mvcsttgabon's subfile, aiHl llir NTNl 
im’esupafive file numbci. STATS subfile 


(I") Other Statistical AccomplisbHients 


(U//FOUO) Undei the NTNI, olhei measures will be established to Mu^jh^eifomianci^ 
LTCEs These \«11 mcUide measures siinitai to the 
|[ieslncted access] foan's statistical accomplislimexits used foi CHSs 



(Si’TREL TO USA, FVEY) Other specific online paianieters aie also introduced, mcludtng die 
chnation online, the number of postings made, the extremist onlme venue identified (e g., blog or 
Web site), and onlme personas created 


P,?,®. (Lr) Franchise Opera tioii Accounting and Budget 


(l?//FOUO) Each FOP undei NTNl assigns an FBI employee to act as the mvestigatioii 
accountant andfor financial analyst. That person is responsible for ensuring the FOP is compliant 
widi the guidance set forth in the Conpdmtial Funding Potny Guide (0248 PG) . 
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